auditing-http2-and-grpc-multiplexing-trust

name	auditing-http2-and-grpc-multiplexing-trust
description	Audit HTTP/2 and gRPC edges for framing and multiplexing trust that breaks when a stream is translated or reused: an h2c or HTTP/2-to-HTTP/1.1 downgrade that reintroduces request smuggling, pseudo-header and header handling that lets a stream forge its path or authority, multiplexed streams on one connection whose authentication or rate limit is applied per connection rather than per stream, and a gRPC gateway that trusts metadata or a method name a caller controls. Covers HTTP/2 front ends, gRPC services, and gateways that translate between protocols. Use when an edge terminates or downgrades HTTP/2 or multiplexes gRPC calls and per-stream trust is assumed. The crafted stream or metadata is the source, the back-end request or method it reaches is the sink, and the downgrade or per-connection trust that admits it is the bug.
license	MIT

Auditing HTTP/2 and gRPC multiplexing trust: when a stream is not what the connection claims

HTTP/2 and gRPC move the unit of a request from a connection to a stream: one connection carries many interleaved streams, each with its own headers, pseudo-headers, and path. Trust decisions that were written for one-request-per-connection quietly break here. A downgrade seam, HTTP/2 translated to HTTP/1.1 at the origin, or cleartext h2c smuggled past a front end, reintroduces the framing ambiguity of request smuggling in a protocol that was supposed to have solved it. Pseudo-headers like the authority and path are attacker-set per stream, so a stream can claim a path or host the front end never authorized. And per-connection controls, authentication established once, a rate limit counted per connection, are undercounted when many streams share the connection. A gRPC gateway adds method names and metadata a caller controls. The audit asks whether trust is enforced per stream and whether translation preserves the framing. You audit this by testing each stream and each downgrade seam rather than trusting the connection.