Later archive addition

HTTP/3 connection contamination: an upcoming threat?

James Kettle · PortSwigger Research · 19 October 2022

Browsers coalesce requests for different hostnames onto one HTTP/2 or HTTP/3 connection when the hosts share an IP address and certificate, while a reverse proxy that picks its backend from the first request on a connection then misroutes everything after it. XSS on one sibling host therefore becomes control of a more sensitive one, and HTTP/3 removes the IP-match requirement.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

19 October 2022

In the archive

• Added to the 2022 archive after the original list was published

Related sources

• Earlier research
• Detection extension
• Talk recording

Tags

• sop-bypass
• http3
• http2
• reverse-proxy
• xss
• tls
• load-balancer
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host.