HTTP/2 Max Requests in HTTP Protocol Constraints for protection against HTTP/2 Rapid Reset Attack

[romank]

Hello.

Regarding:

https://community.fortinet.com/t5/FortiWeb/Outbreak-Alert-HTTP-2-Rapid-Reset-Attack-and-Mitigation/ta-p/278958

Topic is about "HTTP/2", so question is, if some service isnt using HTTP/2 scheme, then is it vuln?

Please see attached screenshot example?

[srajeswaran]

This attack leverages a flaw in the implementation of protocol HTTP/2, so if your server don't use HTTP/2, then the attack don't affect it.

https://www.fortiguard.com/threat-signal-report/5286/http-2-rapid-reset-attack

[romank]

Destination server may use, but what if fortiweb has it ticked on? or opposite? 

[srajeswaran]

I believe the screenshot is from a server policy config , if so unless you enable this option FortiWeb won't negotiate the HTTP/2 connections with the clients.

ref: https://help.fortinet.com/fweb/582/Content/FortiWeb/fortiweb-admin/configure_server_policy.htm

[romank]

yeap screenshot is from Server policy config, so theoretically IF its not ticked(on) then scheme is taken from destination server itself :) Or by default, FortiWeb is using /1.1 ? and If, lets say that my destination server is able to use http/2 but http/2 isnt ticked on server policy, will it use 1.1 or http/2(from srv)?

My understanding is that, it should use 1.1 if http/2 isnt ticked on. Cuz client is connectiong with WAF first, and then forwarded to dest server ;) 

[srajeswaran · Accepted solution]

Your understanding is correct.