{"action":"closed","number":651,"pull_request":{"url":"https://api.github.com/repos/httpwg/http-extensions/pulls/651","id":194398376,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk0Mzk4Mzc2","html_url":"https://github.com/httpwg/http-extensions/pull/651","diff_url":"https://github.com/httpwg/http-extensions/pull/651.diff","patch_url":"https://github.com/httpwg/http-extensions/pull/651.patch","issue_url":"https://api.github.com/repos/httpwg/http-extensions/issues/651","number":651,"state":"closed","locked":false,"title":"Man-in-the-middle protection via SETTINGS","user":{"login":"MikeBishop","id":4273797,"node_id":"MDQ6VXNlcjQyNzM3OTc=","avatar_url":"https://avatars0.githubusercontent.com/u/4273797?v=4","gravatar_id":"","url":"https://api.github.com/users/MikeBishop","html_url":"https://github.com/MikeBishop","followers_url":"https://api.github.com/users/MikeBishop/followers","following_url":"https://api.github.com/users/MikeBishop/following{/other_user}","gists_url":"https://api.github.com/users/MikeBishop/gists{/gist_id}","starred_url":"https://api.github.com/users/MikeBishop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MikeBishop/subscriptions","organizations_url":"https://api.github.com/users/MikeBishop/orgs","repos_url":"https://api.github.com/users/MikeBishop/repos","events_url":"https://api.github.com/users/MikeBishop/events{/privacy}","received_events_url":"https://api.github.com/users/MikeBishop/received_events","type":"User","site_admin":false},"body":"Fixes #617.\r\n\r\nSpecifies an exporter-derived value in SETTINGS to prove that the TLS connection is between the same endpoints as the HTTP connection.  If there is a TLS-terminating proxy intermediating the connection, the expected value will not match the received value, and the work of producing exported authenticators can be skipped.\r\n\r\nOne open question is around the use of early exporters.  I think this is probably something we want, so that servers can send additional certificates in their 0.5-RTT flight to 0-RTT clients.  However, should clients be required to supply a value derived from a regular exporter after the handshake finishes?  This is a minor pain in H2, but in HTTP/QUIC would require defining a separate frame type to carry the updated token.  The obvious value is that the server could still validate the token after forgetting the 0-RTT secret, but it seems like the server could as easily validate the setting early and remember the result even after discarding the secret.  Is there any additional security benefit to the client re-proving the connection is end-to-end after the handshake completes?","created_at":"2018-06-12T20:28:27Z","updated_at":"2018-06-13T23:50:39Z","closed_at":"2018-06-13T23:50:39Z","merged_at":"2018-06-13T23:50:39Z","merge_commit_sha":"1a87c91d36e673b360042683a3113a3d7a585525","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":109132722,"node_id":"MDU6TGFiZWwxMDkxMzI3MjI=","url":"https://api.github.com/repos/httpwg/http-extensions/labels/design","name":"design","color":"0052cc","default":false},{"id":772216980,"node_id":"MDU6TGFiZWw3NzIyMTY5ODA=","url":"https://api.github.com/repos/httpwg/http-extensions/labels/secondary-certs","name":"secondary-certs","color":"fbca04","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/httpwg/http-extensions/pulls/651/commits","review_comments_url":"https://api.github.com/repos/httpwg/http-extensions/pulls/651/comments","review_comment_url":"https://api.github.com/repos/httpwg/http-extensions/pulls/comments{/number}","comments_url":"https://api.github.com/repos/httpwg/http-extensions/issues/651/comments","statuses_url":"https://api.github.com/repos/httpwg/http-extensions/statuses/91e306eed0df46a4e2ef6b27b14e274c124abeec","head":{"label":"httpwg:sc/mitm","ref":"sc/mitm","sha":"91e306eed0df46a4e2ef6b27b14e274c124abeec","user":{"login":"httpwg","id":6490222,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY0OTAyMjI=","avatar_url":"https://avatars3.githubusercontent.com/u/6490222?v=4","gravatar_id":"","url":"https://api.github.com/users/httpwg","html_url":"https://github.com/httpwg","followers_url":"https://api.github.com/users/httpwg/followers","following_url":"https://api.github.com/users/httpwg/following{/other_user}","gists_url":"https://api.github.com/users/httpwg/gists{/gist_id}","starred_url":"https://api.github.com/users/httpwg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/httpwg/subscriptions","organizations_url":"https://api.github.com/users/httpwg/orgs","repos_url":"https://api.github.com/users/httpwg/repos","events_url":"https://api.github.com/users/httpwg/events{/privacy}","received_events_url":"https://api.github.com/users/httpwg/received_events","type":"Organization","site_admin":false},"repo":{"id":20987583,"node_id":"MDEwOlJlcG9zaXRvcnkyMDk4NzU4Mw==","name":"http-extensions","full_name":"httpwg/http-extensions","owner":{"login":"httpwg","id":6490222,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY0OTAyMjI=","avatar_url":"https://avatars3.githubusercontent.com/u/6490222?v=4","gravatar_id":"","url":"https://api.github.com/users/httpwg","html_url":"https://github.com/httpwg","followers_url":"https://api.github.com/users/httpwg/followers","following_url":"https://api.github.com/users/httpwg/following{/other_user}","gists_url":"https://api.github.com/users/httpwg/gists{/gist_id}","starred_url":"https://api.github.com/users/httpwg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/httpwg/subscriptions","organizations_url":"https://api.github.com/users/httpwg/orgs","repos_url":"https://api.github.com/users/httpwg/repos","events_url":"https://api.github.com/users/httpwg/events{/privacy}","received_events_url":"https://api.github.com/users/httpwg/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/httpwg/http-extensions","description":"HTTP Extensions in progress","fork":false,"url":"https://api.github.com/repos/httpwg/http-extensions","forks_url":"https://api.github.com/repos/httpwg/http-extensions/forks","keys_url":"https://api.github.com/repos/httpwg/http-extensions/keys{/key_id}","collaborators_url":"https://api.github.com/repos/httpwg/http-extensions/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/httpwg/http-extensions/teams","hooks_url":"https://api.github.com/repos/httpwg/http-extensions/hooks","issue_events_url":"https://api.github.com/repos/httpwg/http-extensions/issues/events{/number}","events_url":"https://api.github.com/repos/httpwg/http-extensions/events","assignees_url":"https://api.github.com/repos/httpwg/http-extensions/assignees{/user}","branches_url":"https://api.github.com/repos/httpwg/http-extensions/branches{/branch}","tags_url":"https://api.github.com/repos/httpwg/http-extensions/tags","blobs_url":"https://api.github.com/repos/httpwg/http-extensions/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/httpwg/http-extensions/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/httpwg/http-extensions/git/refs{/sha}","trees_url":"https://api.github.com/repos/httpwg/http-extensions/git/trees{/sha}","statuses_url":"https://api.github.com/repos/httpwg/http-extensions/statuses/{sha}","languages_url":"https://api.github.com/repos/httpwg/http-extensions/languages","stargazers_url":"https://api.github.com/repos/httpwg/http-extensions/stargazers","contributors_url":"https://api.github.com/repos/httpwg/http-extensions/contributors","subscribers_url":"https://api.github.com/repos/httpwg/http-extensions/subscribers","subscription_url":"https://api.github.com/repos/httpwg/http-extensions/subscription","commits_url":"https://api.github.com/repos/httpwg/http-extensions/commits{/sha}","git_commits_url":"https://api.github.com/repos/httpwg/http-extensions/git/commits{/sha}","comments_url":"https://api.github.com/repos/httpwg/http-extensions/comments{/number}","issue_comment_url":"https://api.github.com/repos/httpwg/http-extensions/issues/comments{/number}","contents_url":"https://api.github.com/repos/httpwg/http-extensions/contents/{+path}","compare_url":"https://api.github.com/repos/httpwg/http-extensions/compare/{base}...{head}","merges_url":"https://api.github.com/repos/httpwg/http-extensions/merges","archive_url":"https://api.github.com/repos/httpwg/http-extensions/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/httpwg/http-extensions/downloads","issues_url":"https://api.github.com/repos/httpwg/http-extensions/issues{/number}","pulls_url":"https://api.github.com/repos/httpwg/http-extensions/pulls{/number}","milestones_url":"https://api.github.com/repos/httpwg/http-extensions/milestones{/number}","notifications_url":"https://api.github.com/repos/httpwg/http-extensions/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/httpwg/http-extensions/labels{/name}","releases_url":"https://api.github.com/repos/httpwg/http-extensions/releases{/id}","deployments_url":"https://api.github.com/repos/httpwg/http-extensions/deployments","created_at":"2014-06-19T04:22:51Z","updated_at":"2018-06-13T08:49:47Z","pushed_at":"2018-06-13T23:50:39Z","git_url":"git://github.com/httpwg/http-extensions.git","ssh_url":"git@github.com:httpwg/http-extensions.git","clone_url":"https://github.com/httpwg/http-extensions.git","svn_url":"https://github.com/httpwg/http-extensions","homepage":"https://httpwg.github.io/","size":19381,"stargazers_count":151,"watchers_count":151,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":40,"mirror_url":null,"archived":false,"open_issues_count":39,"license":null,"forks":40,"open_issues":39,"watchers":151,"default_branch":"master"}},"base":{"label":"httpwg:master","ref":"master","sha":"bcd334e124e530215b860078889e9bcbc71fcb7e","user":{"login":"httpwg","id":6490222,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY0OTAyMjI=","avatar_url":"https://avatars3.githubusercontent.com/u/6490222?v=4","gravatar_id":"","url":"https://api.github.com/users/httpwg","html_url":"https://github.com/httpwg","followers_url":"https://api.github.com/users/httpwg/followers","following_url":"https://api.github.com/users/httpwg/following{/other_user}","gists_url":"https://api.github.com/users/httpwg/gists{/gist_id}","starred_url":"https://api.github.com/users/httpwg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/httpwg/subscriptions","organizations_url":"https://api.github.com/users/httpwg/orgs","repos_url":"https://api.github.com/users/httpwg/repos","events_url":"https://api.github.com/users/httpwg/events{/privacy}","received_events_url":"https://api.github.com/users/httpwg/received_events","type":"Organization","site_admin":false},"repo":{"id":20987583,"node_id":"MDEwOlJlcG9zaXRvcnkyMDk4NzU4Mw==","name":"http-extensions","full_name":"httpwg/http-extensions","owner":{"login":"httpwg","id":6490222,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY0OTAyMjI=","avatar_url":"https://avatars3.githubusercontent.com/u/6490222?v=4","gravatar_id":"","url":"https://api.github.com/users/httpwg","html_url":"https://github.com/httpwg","followers_url":"https://api.github.com/users/httpwg/followers","following_url":"https://api.github.com/users/httpwg/following{/other_user}","gists_url":"https://api.github.com/users/httpwg/gists{/gist_id}","starred_url":"https://api.github.com/users/httpwg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/httpwg/subscriptions","organizations_url":"https://api.github.com/users/httpwg/orgs","repos_url":"https://api.github.com/users/httpwg/repos","events_url":"https://api.github.com/users/httpwg/events{/privacy}","received_events_url":"https://api.github.com/users/httpwg/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/httpwg/http-extensions","description":"HTTP Extensions in progress","fork":false,"url":"https://api.github.com/repos/httpwg/http-extensions","forks_url":"https://api.github.com/repos/httpwg/http-extensions/forks","keys_url":"https://api.github.com/repos/httpwg/http-extensions/keys{/key_id}","collaborators_url":"https://api.github.com/repos/httpwg/http-extensions/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/httpwg/http-extensions/teams","hooks_url":"https://api.github.com/repos/httpwg/http-extensions/hooks","issue_events_url":"https://api.github.com/repos/httpwg/http-extensions/issues/events{/number}","events_url":"https://api.github.com/repos/httpwg/http-extensions/events","assignees_url":"https://api.github.com/repos/httpwg/http-extensions/assignees{/user}","branches_url":"https://api.github.com/repos/httpwg/http-extensions/branches{/branch}","tags_url":"https://api.github.com/repos/httpwg/http-extensions/tags","blobs_url":"https://api.github.com/repos/httpwg/http-extensions/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/httpwg/http-extensions/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/httpwg/http-extensions/git/refs{/sha}","trees_url":"https://api.github.com/repos/httpwg/http-extensions/git/trees{/sha}","statuses_url":"https://api.github.com/repos/httpwg/http-extensions/statuses/{sha}","languages_url":"https://api.github.com/repos/httpwg/http-extensions/languages","stargazers_url":"https://api.github.com/repos/httpwg/http-extensions/stargazers","contributors_url":"https://api.github.com/repos/httpwg/http-extensions/contributors","subscribers_url":"https://api.github.com/repos/httpwg/http-extensions/subscribers","subscription_url":"https://api.github.com/repos/httpwg/http-extensions/subscription","commits_url":"https://api.github.com/repos/httpwg/http-extensions/commits{/sha}","git_commits_url":"https://api.github.com/repos/httpwg/http-extensions/git/commits{/sha}","comments_url":"https://api.github.com/repos/httpwg/http-extensions/comments{/number}","issue_comment_url":"https://api.github.com/repos/httpwg/http-extensions/issues/comments{/number}","contents_url":"https://api.github.com/repos/httpwg/http-extensions/contents/{+path}","compare_url":"https://api.github.com/repos/httpwg/http-extensions/compare/{base}...{head}","merges_url":"https://api.github.com/repos/httpwg/http-extensions/merges","archive_url":"https://api.github.com/repos/httpwg/http-extensions/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/httpwg/http-extensions/downloads","issues_url":"https://api.github.com/repos/httpwg/http-extensions/issues{/number}","pulls_url":"https://api.github.com/repos/httpwg/http-extensions/pulls{/number}","milestones_url":"https://api.github.com/repos/httpwg/http-extensions/milestones{/number}","notifications_url":"https://api.github.com/repos/httpwg/http-extensions/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/httpwg/http-extensions/labels{/name}","releases_url":"https://api.github.com/repos/httpwg/http-extensions/releases{/id}","deployments_url":"https://api.github.com/repos/httpwg/http-extensions/deployments","created_at":"2014-06-19T04:22:51Z","updated_at":"2018-06-13T08:49:47Z","pushed_at":"2018-06-13T23:50:39Z","git_url":"git://github.com/httpwg/http-extensions.git","ssh_url":"git@github.com:httpwg/http-extensions.git","clone_url":"https://github.com/httpwg/http-extensions.git","svn_url":"https://github.com/httpwg/http-extensions","homepage":"https://httpwg.github.io/","size":19381,"stargazers_count":151,"watchers_count":151,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":40,"mirror_url":null,"archived":false,"open_issues_count":39,"license":null,"forks":40,"open_issues":39,"watchers":151,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/httpwg/http-extensions/pulls/651"},"html":{"href":"https://github.com/httpwg/http-extensions/pull/651"},"issue":{"href":"https://api.github.com/repos/httpwg/http-extensions/issues/651"},"comments":{"href":"https://api.github.com/repos/httpwg/http-extensions/issues/651/comments"},"review_comments":{"href":"https://api.github.com/repos/httpwg/http-extensions/pulls/651/comments"},"review_comment":{"href":"https://api.github.com/repos/httpwg/http-extensions/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/httpwg/http-extensions/pulls/651/commits"},"statuses":{"href":"https://api.github.com/repos/httpwg/http-extensions/statuses/91e306eed0df46a4e2ef6b27b14e274c124abeec"}},"author_association":"CONTRIBUTOR","merged":true,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":{"login":"MikeBishop","id":4273797,"node_id":"MDQ6VXNlcjQyNzM3OTc=","avatar_url":"https://avatars0.githubusercontent.com/u/4273797?v=4","gravatar_id":"","url":"https://api.github.com/users/MikeBishop","html_url":"https://github.com/MikeBishop","followers_url":"https://api.github.com/users/MikeBishop/followers","following_url":"https://api.github.com/users/MikeBishop/following{/other_user}","gists_url":"https://api.github.com/users/MikeBishop/gists{/gist_id}","starred_url":"https://api.github.com/users/MikeBishop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MikeBishop/subscriptions","organizations_url":"https://api.github.com/users/MikeBishop/orgs","repos_url":"https://api.github.com/users/MikeBishop/repos","events_url":"https://api.github.com/users/MikeBishop/events{/privacy}","received_events_url":"https://api.github.com/users/MikeBishop/received_events","type":"User","site_admin":false},"comments":2,"review_comments":0,"maintainer_can_modify":false,"commits":4,"additions":29,"deletions":2,"changed_files":1}}
{"actor":{"display_login":"MikeBishop"}}