Enhancing security of sensitive data in HTTP/2 and HTTP/3 connections
An approach is disclosed for processing one or more HTTP requests and responses, by a protection solution, where a version of the plurality of HTTP requests and responses is at least version 2. When an HTTP settings request is detected in the one or more HTTP requests, by the protection solution, a protected dynamic dictionary is allocated in a protected memory area and an allocation of an application dynamic dictionary in application space in an HTTP server is prevented. When an HTTP header request is detected in the one or more HTTP requests, fields of the HTTP header are decompressed into the protected dynamic dictionary, the HTTP header request is updated to form an updated header request based on content in the protected dynamic dictionary, and the updated header request is sent to the HTTP server.
1 . A method for enhancing security of sensitive data in Hypertext Transfer Protocol (HTTP) connections comprising:
processing a plurality of HTTP requests and responses, by a protection solution,
wherein a version of the plurality of HTTP requests and responses is at least version 2;
responsive to detecting an HTTP settings request in the plurality of HTTP requests, by the protection solution,
allocating a protected dynamic dictionary in a protected memory area and preventing allocation of an application dynamic dictionary in application space in an HTTP server; and
responsive to detecting an HTTP header request in the plurality of HTTP requests,
decompressing fields of the HTTP header into the protected dynamic dictionary, updating the HTTP header request to form an updated header request based on content in the protected dynamic dictionary, and sending the updated header request to the HTTP server.
2 . The method of claim 1 , wherein the version of the plurality of HTTP requests and responses is selected from a group consisting of HTTP/2, HTTP/3, and a higher version utilizing header compression.
3 . The method of claim 2 , wherein the higher version utilizes QPACK.
4 . The method of claim 2 , wherein the higher version utilizes HPACK.
5 . The method of claim 1 , wherein the protected dynamic dictionary is allocated from an encrypted area of memory.
6 . The method of claim 1 , wherein the protection solution further comprises:
receiving the plurality of HTTP requests from a Transport Layer Security (TLS) terminator.
7 . The method of claim 6 , wherein the TLS terminator runs as in application in the HTTP server and sends the plurality of decrypted HTTP requests to the protection solution.
8 . The method of claim 1 , wherein the preventing allocation of the application dynamic dictionary in application space in the HTTP server is performed by setting a SETTINGS_MAX_HEADER_LIST_SIZE variable to zero in the HTTP header request.
9 . The method of claim 1 , wherein the processing of the plurality of HTTP requests further comprises:
receiving a plurality of HTTPS requests; and
decrypting the plurality of HTTPS requests to form the plurality of HTTP requests.
10 . The method of claim 1 , further comprising:
analyzing the plurality of HTTP requests and responses to associate a current HTTP request with a current destination for the current HTTP request;
comparing the current destination to a supported set of destinations; and
responsive to determining the current destination is not in the supported set of destinations,
forwarding the current HTTP request to the destination without modifying the current HTTP request;
responsive to determining the current destination is in the supported set of destinations,
checking for an allocation of the protected dynamic dictionary associated with the current destination;
responsive to determining an absence of the allocation of the protected dynamic dictionary associated with the current destination,
allocating the protected dynamic dictionary associated with the current destination and ensuring the current destination does not directly utilize a dynamic dictionary; and
processing the current HTTP request utilizing the protected dynamic dictionary associated with the current destination when the current destination is in the supported set of destinations.
11 . The method of claim 10 , wherein the utilizing of the protected dynamic dictionary associated with the current destination further comprises:
adding selected entries from a current header of the current HTTP request to the dynamic dictionary if needed;
updating the current header of the current HTTP request from the dynamic dictionary to form an updated current HTTP request; and
forwarding the updated current HTTP request to the current destination.
12 . An information handling system for enhancing security of sensitive data in Hypertext Transfer Protocol (HTTP) connections comprising:
one or more processors;
a memory coupled to at least one of the processors;
a network interface that connects the local device to one or more remote web sites; and
a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions comprising:
processing a plurality of HTTP requests and responses, by a protection solution, wherein a version of the plurality of HTTP requests and responses is at least version 2;
responsive to detecting an HTTP settings request in the plurality of HTTP requests, by the protection solution,
allocating a protected dynamic dictionary in a protected memory area and preventing allocation of an application dynamic dictionary in application space in an HTTP server; and
responsive to detecting an HTTP header request in the plurality of HTTP requests, decompressing fields of the HTTP header into the protected dynamic dictionary, updating the HTTP header request to form an updated header request based on content in the protected dynamic dictionary, and sending the updated header request to the HTTP server.
13 . The information handling system of claim 12 , wherein the version of the plurality of HTTP requests and responses is selected from a group consisting of HTTP/2, HTTP/3, and a higher version utilizing header compression.
14 . The information handling system of claim 13 , wherein the higher version utilizes QPACK.
15 . The information handling system of claim 13 , wherein the higher version utilizes H PACK.
16 . A computer program product for enhancing security of sensitive data in Hypertext Transfer Protocol (HTTP) connections stored in a computer readable storage medium, comprising computer program code that, when executed by the computer program product, performs actions comprising:
processing a plurality of HTTP requests and responses, by a protection solution, wherein a version of the plurality of HTTP requests and responses is at least version 2;
responsive to detecting an HTTP settings request in the plurality of HTTP requests, by the protection solution,
allocating a protected dynamic dictionary in a protected memory area and preventing allocation of an application dynamic dictionary in application space in an HTTP server; and
responsive to detecting an HTTP header request in the plurality of HTTP requests, decompressing fields of the HTTP header into the protected dynamic dictionary, updating the HTTP header request to form an updated header request based on content in the protected dynamic dictionary, and sending the updated header request to the HTTP server.
17 . The computer program product of claim 16 , wherein the version of the plurality of HTTP requests and responses is selected from a group consisting of HTTP/2, HTTP/3, and a higher version utilizing header compression.
18 . The computer program product of claim 17 , wherein the higher version utilizes QPACK.
19 . The computer program product of claim 17 , wherein the higher version utilizes HPACK.
20 . The computer program product of claim 16 , wherein the protected dynamic dictionary is allocated from an encrypted area of memory.