HTTP/2 normalization in the message editor - Port Swigger
Summary: Burp Suite's message editor displays HTTP/2 requests using HTTP/1-style syntax, mapping the request line to the :method and :path pseudo-headers and deriving :authority from the Host header, then reversing the process when edits are made. When converting edited HTTP/1-style input to HTTP/2, Burp lowercases capital letters in header names, strips the Connection header if present, and returns a moved Host header to its original position, updating the editor to show any normalization performed.
Bottom line: The normalization exists so that a syntactically valid HTTP/1 request becomes an HTTP/2 request that adheres to the specification, since otherwise it would be easy to accidentally create requests many servers would reject. Sending non-normalized requests requires editing in the Inspector instead, and the Connection header is still stripped by default unless changed from the Repeater menu.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026