Disable HTTP2

HTTP version 2 is not used by the clients so having it enabled just makes attack surface bigger without providing benefits.
Kixunil · Jul 13, 2024 · 8f9bcb1 · 8f9bcb1
1 parent 79de95c
commit 8f9bcb1
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 51 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -35,7 +35,7 @@ configure_me = { version = "0.4.0" }
 futures = "0.3.12"
 hex = "0.4.2"
 http = "0.2.3"
-hyper = { version = "0.14.4", features = ["client", "server", "stream", "http2", "http1", "tcp"] }
+hyper = { version = "0.14.4", features = ["client", "server", "stream", "http1", "tcp"] }
 itertools = "0.10.0"
 lazy_static = "1.4.0"
 linear-map = { version = "1.2.0", features = ["serde_impl"] }

diff --git a/src/lib.rs b/src/lib.rs
@@ -55,6 +55,7 @@ pub async fn compat_main(
     let server = Server::builder(hyper::server::accept::from_stream(TcpListenerCompat(
         listener,
     )))
+    .http1_only(true)
     .serve(make_service);
 
     Ok(server.await?)