> ok, ясно, а как же быть с protocol violation, когда браузер ожидает

можете не отвечать, Internet Explorer - ясно все, удивляться нечему.

Is my browser/client vulnerable?
Internet Explorer and Edge Legacy (i.e., those not based on Chrome) are "more" vulnerable than other browsers, because they block fewer ports and perform content-sniffing. Content-sniffing is dangerous, because it enables JavaScript code execution in server responses that are noisy due to error messages by the application server that implements a protocol different from HTTP. This means that the pure web attacker variant of ALPACA is more dangerous for users of such browsers than for other users.

However, no browser protects the user against all possible ALPACA attacks. In particular, all browsers can be compromised by a Man-in-the-Middle attacker who has write-access to an error-tolerant FTP server presenting a certificate compatible with a target web server under attack. Although the FTP server can in theory protect against this particular attack by detecting HTTP POST requests and/or terminating the connection after a small number of errors, this attack variant shows that this is not a bug in the browser, the web server, or the application server, but an emergent property of the TLS landscape.