&gt;I seem to have created the impression that there is some risk to having every HTTP request start with a fixed string<p>Every HTTP request does not start with a fixed string. Every HTTP2 request apparently does (if I have read correctly).<p>&gt;There is not.<p>Why not? What allows AES to escape such an attack?