为什么HTTP / 2的浏览器实现需要TLS？ [英] Why do browser implementations of HTTP/2 require TLS?

问题描述

为什么大多数现代浏览器都需要HTTP2的TLS？

Why does most modern browsers require TLS for HTTP2?

这背后有技术原因吗？或只是为了让网络更安全？

Is there a technical reason behind this? Or simply just to make the web more secure?

http ：//caniuse.com/#feat=http2

推荐答案

这部分是关于使更多的东西使用HTTPS和鼓励用户和服务器使用HTTPS。 Firefox和Chrome开发者都表示这通常很好。为了用户和用户的安全和隐私。

It is partly about making more things use HTTPS and encourage users and servers to go HTTPS. Both Firefox and Chrome developers have stated this to be generally good. For the sake of users and users' security and privacy.

这也是关于在Internet上部署的假设TCP流量超过端口80的中间盒看起来像HTTP / 1.1）意味着HTTP / 1.1，然后他们会干涉，以改善或以某种方式过滤流量。在这样的网络上执行HTTP / 2清除文本的成功率要差得多。坚持加密使得那些中间盒子永远不会弄坏流量。

It is also about broken "middle boxes" deployed on the Internet that assume TCP traffic over port 80 (that might look like HTTP/1.1) means HTTP/1.1 and then they will interfere in order to "improve" or filter the traffic in some way. Doing HTTP/2 clear text over such networks end up with a much worse success rate. Insisting on encryption makes those middle boxes never get the chance to mess up the traffic.

此外，部署的HTTP / 1.1服务器有一定比例会返回一个错误响应升级：使用未知协议（例如h2c，即明文中的HTTP / 2），这也会使广泛使用的浏览器中的实现复杂化。通过HTTPS进行协商并不容易出错，因为不支持它仅仅意味着切换到安全的旧HTTP / 1.1方法。

Further, there are a certain percentage of deployed HTTP/1.1 servers that will return an error response to an Upgrade: with an unknown protocol (such as "h2c", which is HTTP/2 in clear text) which also would complicate an implementation in a widely used browser. Doing the negotiation over HTTPS is much less error prone as "not supporting it" simply means switching down to the safe old HTTP/1.1 approach.

这篇关于为什么HTTP / 2的浏览器实现需要TLS？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！