This RFC includes not only the definition of CONNECT, but alternatively, the use of an Upgrade header to convert a regular HTTP connection to HTTPS, either with optional or mandatory encryption. It was like STARTTLS for HTTP, in a way.
CONNECT won out in the real world, of course, but I find this lost feature kind of fascinating.
Quick comparison:
- Upgrade is a hop-by-hop header. The browser/proxy and proxy/upstream connection MAY be using different levels of encryption.
- When using Upgrade, the proxy needs a valid TLS certificate to handle encrypting traffic with its clients.
- Also, this means the proxy can still view/cache/log the data that was encrypted on the wire.
CONNECT is basically the opposite: once the request is made and the proxy allows it, the proxy reverts to being just as dumb as any router on the Internet. All it can do is shuttle the bytes, so the same bytes that leave the origin end up at the client without any caching or interpretation. Since CONNECT is mainly used for HTTPS, those bytes are most often encrypted, as well.
Google may have tried the Upgrade header when first developing SPDY, but they didn’t like the extra round-trip nor the ability for intermediate devices on the network to interfere (intentionally or otherwise.) So it didn’t end up getting resurrected from the dustbin of history for that, either.
So maybe I didn’t learn about it today, but only rediscovered it.
No comments:
Post a Comment