I thought HTTP2 smuggling was going to be waaaay harder that HTTP/1.1 but it turns out its really common to downgrade to 1.1 between the front end and the server. And HTTP/2 just ignores headers its not interested in. #bscp #portswigger #httpsmuggling #appsec