auditing-http2-and-grpc-multiplexing-trustlisted

# Auditing HTTP/2 and gRPC multiplexing trust: when a stream is not what the connection claims HTTP/2 and gRPC move the unit of a request from a connection to a stream: one connection carries many interleaved streams, each with its own headers, pseudo-headers, and path. Trust decisions that were written for one-request-per-connection quietly break here. A downgrade seam, HTTP/2 translated to HTTP/1.1 at the origin, or cleartext h2c smuggled past a front end, reintroduces the framing ambiguity of request smuggling in a protocol that was supposed to have solved it. Pseudo-headers like the authority and path are attacker-set per stream, so a stream can claim a path or host the front end never authorized. And per-connection controls, authentication established once, a rate limit counted per connection, are undercounted when many streams share the connection. A gRPC gateway adds method names and metadata a caller controls. The audit asks whether trust is enforced per stream and whether translation preserves the framing. You audit this by testing each stream and each downgrade seam rather than trusting the connection. ## When to use - An edge terminates, downgrades, or translates HTTP/2, including h2c or HTTP/2-to-HTTP/1.1 to an origin. - gRPC calls are multiplexed on shared connections and authentication or rate limits may be per connection. - A gRPC gateway trusts caller-supplied metadata, method names, or pseudo-headers to route or authorize. ## Scope check Test HTTP/2 and