Package io.netty.handler.codec.http3

Interface QpackSensitivityDetector

  • public interface QpackSensitivityDetector
    Determines whether a header field is sensitive, in which case the QPACK encoder
    • MUST NOT insert it into the dynamic table, and
    • MUST encode it as a literal with the "Never Indexed" (N=1) flag set as defined in RFC 9204 4.5.4 through 4.5.7.

    This mirrors io.netty.handler.codec.http2.Http2HeadersEncoder.SensitivityDetector from the HTTP/2 / HPACK side.

    Setting N=1 prevents intermediaries from inserting the field into their own dynamic tables, which mitigates information disclosure via compression-based side channels (RFC 9204 7.1) for credentials such as Authorization, Cookie, Set-Cookie and Proxy-Authorization.

    If the object can be dynamically modified and shared across multiple connections it may need to be thread safe.

    • Field Detail

      • NEVER_SENSITIVE

        static final QpackSensitivityDetector NEVER_SENSITIVE
        Treats every header field as non-sensitive. This is the historical default behaviour of the QPACK encoder and is the backward-compatible choice.

    • Method Detail

      • isSensitive

        boolean isSensitive​(java.lang.CharSequence name,
                    java.lang.CharSequence value)
        Determine if a header name/value pair is sensitive.
        Parameters:
        name - the header field name.
        value - the header field value.
        Returns:
        true if the field is sensitive and must be encoded with N=1 and excluded from the dynamic table; false otherwise.