为什么浏览器实现 HTTP/2 需要 TLS? [英] Why do browser implementations of HTTP/2 require TLS?

问题描述

为什么大多数现代浏览器都需要 HTTP2 的 TLS?

Why does most modern browsers require TLS for HTTP2?

这背后有技术原因吗?或者只是为了让网络更安全?

Is there a technical reason behind this? Or simply just to make the web more secure?

http://caniuse.com/#feat=http2

推荐答案

部分原因是为了让更多的东西使用 HTTPS 并鼓励用户和服务器使用 HTTPS.Firefox 和 Chrome 开发人员都表示这总体上是好的.为了用户和用户的安全和隐私.

It is partly about making more things use HTTPS and encourage users and servers to go HTTPS. Both Firefox and Chrome developers have stated this to be generally good. For the sake of users and users' security and privacy.

这也是关于部署在 Internet 上的损坏的中间盒"，假设端口 80 上的 TCP 流量(可能看起来像 HTTP/1.1)意味着 HTTP/1.1，然后它们会干扰以改进"或过滤以某种方式交通.在这样的网络上执行 HTTP/2 明文最终的成功率要差得多.坚持加密让那些中间的盒子永远没有机会搞乱流量.

It is also about broken "middle boxes" deployed on the Internet that assume TCP traffic over port 80 (that might look like HTTP/1.1) means HTTP/1.1 and then they will interfere in order to "improve" or filter the traffic in some way. Doing HTTP/2 clear text over such networks end up with a much worse success rate. Insisting on encryption makes those middle boxes never get the chance to mess up the traffic.

此外，有一定比例的已部署 HTTP/1.1 服务器会向升级返回错误响应:使用未知协议(例如h2c"，这是明文的 HTTP/2)，这也会使升级变得复杂在广泛使用的浏览器中的实现.通过 HTTPS 进行协商更不容易出错，因为不支持"只是意味着切换到安全的旧 HTTP/1.1 方法.

Further, there are a certain percentage of deployed HTTP/1.1 servers that will return an error response to an Upgrade: with an unknown protocol (such as "h2c", which is HTTP/2 in clear text) which also would complicate an implementation in a widely used browser. Doing the negotiation over HTTPS is much less error prone as "not supporting it" simply means switching down to the safe old HTTP/1.1 approach.

这篇关于为什么浏览器实现 HTTP/2 需要 TLS?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！