Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The web server must use HTTP/2, at a minimum.
Description
Discussion Text
HTTP/2, like HTTPS, enhances security compared to HTTP/1.x by minimizing the risk of header-based attacks (e.g., header injection and manipulation).
Websites that fully utilize HTTP/2 are inherently protected and defend against smuggling attacks. HTTP/2 provides the method for specifying the length of a request, which removes any potential for ambiguity that can be leveraged by an attacker.
This is applicable to all web architectures such as load balancing/proxy use cases.
- The front-end and back-end servers should both be configured to use HTTP/2.
- HTTP/2 must be used for communications between web servers.
- Browser vendors have agreed to only support HTTP/2 only in HTTPS mode, thus TLS must be configured to meet this requirement. TLS configuration is out of scope for this requirement.
Websites that fully utilize HTTP/2 are inherently protected and defend against smuggling attacks. HTTP/2 provides the method for specifying the length of a request, which removes any potential for ambiguity that can be leveraged by an attacker.
This is applicable to all web architectures such as load balancing/proxy use cases.
- The front-end and back-end servers should both be configured to use HTTP/2.
- HTTP/2 must be used for communications between web servers.
- Browser vendors have agreed to only support HTTP/2 only in HTTPS mode, thus TLS must be configured to meet this requirement. TLS configuration is out of scope for this requirement.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.