logoalt Hacker News

Woodi • today at 11:12 AM • 0 replies • view on HN

But if you have more then one httpd server - eg. some fcgi - then HTTP/1.1 is almost architectural backdor: HTTP Request Smuggling, at minimum.

Apache even don't have it's own HTTP/2: mod_http2 use external library nghttp2[.org] so Apache is dead shell at this point.