Skip to content

MSC4330: specify HTTP and TLS versions which must be supported #4330

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+27 −0
Open

MSC4330: specify HTTP and TLS versions which must be supported #4330

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions proposals/4330-specify-http-versions.md
View file
Open in desktop
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Implementation requirements:

  • Server (Client-Server API)
  • Server (Federation API)
  • Identity Server
  • Push Gateway
  • Application Service
  • Client

For the above, evidence that a majority of existing implementations support the HTTP/2 protocol may be required. Currently Synapse, for example, appears to send out HTTP/1.1 requests.

Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# MSC4330: Specify HTTP and TLS version used for Matrix

Currently there are no HTTP and TLS version mandated by the Matrix spec to be used with the HTTP transport. This
ambiguity is not good for a standard which should be interoperable with different implementations.

## Proposal

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in RFC 2119.

All implementations of the Matrix protocol MUST support HTTP/2 and MAY additionally support HTTP/3 for any HTTP based
transport. Furthermore, all implementations using a transport secured by TLS MUST support TLSv1.2 and SHOULD support any
newer TLS versions.

## Potential issues

\-

## Alternatives

The mininmum HTTP version could be set to HTTP/1.1 instead.

## Security considerations

See RFC9113 (HTTP/2) section 10 and RFC9114 (HTTP/3) section 10. Additionally, future TLS versions may contain security
issues which must be addressed.