Is HTTPS required to support the framing functionality defined in HTTP/2

1

This is followup question to my initial question in TLS header in content portion of HTTPS POST request hot handled well

In that initial question I showed (in the 2nd capture) unencrypted TLS messages between two embedded devices. The "client" sends the HTTP headers in one frame and the HTTP data in another. The embedded device acting as the server sends a 400 response. An answer was provided by Steffen Ullrich.

In my subsequent reading of internet information if I understand correctly I found that the framing functionality seems to have been added in HTTP/2 and was not part of HTTP/1.x. I also found in https://www.keycdn.com/blog/difference-between-http-and-https/ that HTTPS is supposed to support the framing functionality of HTTP/2.

What I am asking here is for verification of that statement. Even if in the HTTPS POST request we specify HTTP/1.1, per HTTPS is the embedded server required to support framing functionality?

The embedded client is using a Linux base utilizing libcurl, openssl. The embedded server is based on Boost libraries as far as I know

C. Brady

Posted 2017-12-14T17:48:31.250

Reputation:

Answers

2

that HTTPS is supposed to support the framing functionality of HTTP/2.

HTTPS does not provide framing for HTTP/2. HTTPS is just HTTP over TLS. TLS has it's own framing of data. HTTP/2 has another framing of data. WebSocket also has framing of data. HTTP/1.x has no framing etc.

Thus, with HTTP/2 without TLS (mostly unsupported) you have only the HTTP/2 framing. With HTTP/2 over TLS you have the HTTP/2 framing "inside" the TLS framing. With WebSockets in HTTP/2 over TLS you have the WebSockets framing and the HTTP/2 framing and the TLS framing. And all these frames are independent of each other, i.e. boundaries can overlap.

A frame is just some kind of unit. It might be exposed to the application as explicit message boundaries as in case of WebSockets. But it might also be just used internally to the protocol and is not exposed to the application as in case of HTTP/2 or TLS.

Even if in the HTTPS POST request we specify HTTP/1.1, per HTTPS is the embedded server required to support framing functionality?

As I've stated in previously: HTTP/1.x treats the underlying transport as stream only with no implicit message boundaries. Thus it does not care about frames in the underlying TLS layer at all. This means for example that the HTTP header might be in one TLS frame and the HTTP body in the next frame. Or 2 bytes of the HTTP header might be in one TLS frame and the rest together with the body in the next frame. Or every byte of the HTTP message might be in a different TLS frame.

Steffen Ullrich

Posted 2017-12-14T17:48:31.250

Reputation: 3 897