http2: add support for sensitive headers

Add support for “sensitive”/“never-indexed” HTTP2 headers.

Fixes: https://github.com/nodejs/node/issues/34091

PR-URL: https://github.com/nodejs/node/pull/34145
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>

1 files changed, 40 insertions, 1 deletions

diff --git a/doc/api/http2.md b/doc/api/http2.md
index c24e43f12b0..122d9deb517 100644
--- a/doc/api/http2.md
+++ b/doc/api/http2.md
@@ -2461,6 +2461,17 @@ added: v8.4.0
 Returns a [HTTP/2 Settings Object][] containing the deserialized settings from
 the given `Buffer` as generated by `http2.getPackedSettings()`.
 
+### `http2.sensitiveHeaders`
+<!-- YAML
+added: REPLACEME
+-->
+
+* {symbol}
+
+This symbol can be set as a property on the HTTP/2 headers object with an array
+value in order to provide a list of headers considered sensitive.
+See [Sensitive headers][] for more details.
+
 ### Headers object
 
 Headers are represented as own-properties on JavaScript objects. The property
@@ -2509,6 +2520,33 @@ server.on('stream', (stream, headers) => {
 });
 ```
 
+<a id="http2-sensitive-headers"></a>
+#### Sensitive headers
+
+HTTP2 headers can be marked as sensitive, which means that the HTTP/2
+header compression algorithm will never index them. This can make sense for
+header values with low entropy and that may be considered valuable to an
+attacker, for example `Cookie` or `Authorization`. To achieve this, add
+the header name to the `[http2.sensitiveHeaders]` property as an array:
+
+```js
+const headers = {
+  ':status': '200',
+  'content-type': 'text-plain',
+  'cookie': 'some-cookie',
+  'other-sensitive-header': 'very secret data',
+  [http2.sensitiveHeaders]: ['cookie', 'other-sensitive-header']
+};
+
+stream.respond(headers);
+```
+
+For some headers, such as `Authorization` and short `Cookie` headers,
+this flag is set automatically.
+
+This property is also set for received headers. It will contain the names of
+all headers marked as sensitive, including ones marked that way automatically.
+
 ### Settings object
 <!-- YAML
 added: v8.4.0
@@ -3696,5 +3734,6 @@ following additional properties:
 [`tls.TLSSocket`]: tls.html#tls_class_tls_tlssocket
 [`tls.connect()`]: tls.html#tls_tls_connect_options_callback
 [`tls.createServer()`]: tls.html#tls_tls_createserver_options_secureconnectionlistener
-[error code]: #error_codes
 [`writable.writableFinished`]: stream.html#stream_writable_writablefinished
+[error code]: #error_codes
+[Sensitive headers]: #http2-sensitive-headers