Overview
This series uses the H3Act study to examine how HTTP/3-to-HTTP/1.1 translation in CDNs can change request meaning across size, timing, identity, framing, and connection state. It moves from RFC 9114's contract through black-box evidence and provider-specific cases to controls and regression tests. Findings concern tested paths and configurations, while connection-contamination guidance comes from a draft, not an adopted standard.
Learning outcomes
- HTTP/3 improves transport, but translation does not automatically preserve application semantics.
- In H3Act's sample, every tested service showed at least one vector, but findings are bounded by tested paths and configurations.
- Reliable diagnosis compares client intent, edge decisions, translated HTTP/1.1 requests, and origin or cache effects.
- Safe operation requires strict validation, per-request identity, bounded upstream commitment, and fresh regression tests for each enabled path.
- Certificate-authorized connection reuse does not replace per-request origin authorization; current `:authority` must control routing or trigger 421.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
What does H3Act measure in CDN infrastructure?
H3Act measures semantic conversion anomalies when CDNs translate HTTP/3 requests to HTTP/1.1, using client observations and controlled-origin records. It does not prove that HTTP/3 itself is unsafe or that every CDN behaves alike.
Why can HTTP/3-to-HTTP/1.1 translation create security problems?
It can create security problems when the edge, cache, router, or origin gives different meanings to authority, limits, bodies, or message boundaries. Transport improvements do not guarantee consistent application semantics after conversion.
How does H3Act distinguish an anomaly from real impact?
H3Act distinguishes them by comparing client intent, the translated request, and origin-side or cache observations, then checking the conditions required for exploitation and production impact. A measured difference alone is not proof of a vulnerability.
Does H3Act show that HTTP/3 is less secure than HTTP/2?
No. H3Act found provider- and path-specific differences, showing that HTTP/2 and HTTP/3 need independent testing rather than proving that either protocol is categorically safer.
Can a reused HTTP/3 connection safely serve another origin?
A reused HTTP/3 connection can safely carry another origin's request only when the server independently routes its current `:authority`; otherwise it should return 421. Certificate coverage permits reuse but does not authorize the backend.