search

rumkin / plant

🌳 JS web server charged with WebAPI and neat HTTP2 support
https://npmjs.com/package/@plant/plant
80 stars 6 forks source link

TLS for HTTP/2 #21

Closed PixnBits closed 4 years ago

PixnBits commented 4 years ago

The README uses @plant/http2 for createServer and @plant/http2 internally uses http2.createServer. The Node.js docs for http2.createServer say

Since there are no browsers known that support unencrypted HTTP/2, the use of http2.createSecureServer() is necessary when communicating with browser clients.

http2.createSecureServer accepts any tls.createServer() options, but http2.createServer makes no mention of these options.

Is a TLS HTTP/2 server supported by plant and I missed how 😅or is that something that would need to be added?

rumkin commented 4 years ago

There is @plant/https2 for this. I separated it to unify package interfaces between versions 1 and 2. Thus we have:

  1. plant/http and plant/https.
  2. plant/http2 and plant/https2.

Plant/http2 may be used with Nginx (or other webserver) which handles TLS itself and returns unencrypted HTTP to your service. I think it's more popular case than direct listening of TLS connection by Node.js itself.

PixnBits commented 4 years ago

Ah, cheers! I missed @plant/https2, which indeed uses http2.createSecureServer 🙇‍♂️ (Even with nginx in front end-to-end encryption can be desirable given attacks in the news. 🤙)