HTTP/1.1 Must Die: The Desync Endgame
PortSwigger Research Director James Kettle argues that HTTP/1.1 is inherently insecure due to weak request boundaries, leading to persistent HTTP request smuggling vulnerabilities. Despite six years of mitigation attempts, the protocol remains vulnerable to desync attacks that can compromise millions of websites. The research introduces novel attack classes capable of mass credential theft, demonstrated through critical vulnerabilities in major infrastructure providers like Akamai, Cloudflare, and Netlify. Kettle presents an open-source toolkit for detecting parser discrepancies, which helped uncover flaws yielding over $200,000 in bug bounties within two weeks. The analysis concludes that individual patches are insufficient because minor implementation bugs in HTTP/1.1 frequently trigger severe security consequences. The paper asserts that HTTP/2+ effectively solves these threats by eliminating the ambiguity inherent in the older text-based protocol. Consequently, the author calls for the immediate deprecation of HTTP/1.1 to secure the web, highlighting that many servers still downgrade HTTP/2 requests to HTTP/1.1 for backend transmission, thereby retaining significant security risks. This comprehensive study serves as a final argument for transitioning entirely to newer, more secure protocols.
Wire timeline
HTTP/1.1 Must Die: The Desync Endgame
PortSwigger Research Director James Kettle argues that HTTP/1.1 is inherently insecure due to weak request boundaries, leading to persistent HTTP request smuggling vulnerabilities. Despite six years of mitigation attempts, the protocol remains vulnerable to desync attacks that can compromise millions of websites. The research introduces novel attack classes capable of mass credential theft, demonstrated through critical vulnerabilities in major infrastructure providers like Akamai, Cloudflare, and Netlify. Kettle presents an open-source toolkit for detecting parser discrepancies, which helped uncover flaws yielding over $200,000 in bug bounties within two weeks. The analysis concludes that individual patches are insufficient because minor implementation bugs in HTTP/1.1 frequently trigger severe security consequences. The paper asserts that HTTP/2+ effectively solves these threats by eliminating the ambiguity inherent in the older text-based protocol. Consequently, the author calls for the immediate deprecation of HTTP/1.1 to secure the web, highlighting that many servers still downgrade HTTP/2 requests to HTTP/1.1 for backend transmission, thereby retaining significant security risks. This comprehensive study serves as a final argument for transitioning entirely to newer, more secure protocols.
PortSwigger Research