HTTP/2 multiplexing carries multiple concurrent request and response streams over one TCP connection. Each stream has an identifier, allowing clients to use one socket for many requests. section 9.3
The mechanism works as follows:
- Clients serialize requests into separate streams over the same connection. section 9.3
- Servers typically allow a maximum of about 100 concurrent streams. section 9.3
- Clients can reset streams they no longer need, releasing capacity for other requests. section 9.3
Rapid reset abuse
A browser may cancel streams for images or text that fall outside the viewport. An attacker instead opens the maximum number of streams, resets them immediately, and repeatedly sends replacements. If the server does not cancel work triggered by those streams, its resources can be exhausted in a denial-of-service attack. section 9.3
Figure 9.15 HTTP/2 uses streams to allow clients to serialize multiple requests over a single TCP connection. Each stream has an identifier, and if the client deems a certain request no longer necessary, it can cancel it with a reset stream request.
Shows stream identifiers, shared TCP transport, and cancellation through a reset-stream request. section 9.3
