Subject: [httpwg/http-extensions] Potential security issues with ORIGIN frame [origin-frame] (#339)

From: HTTP issue updates <[email-masked]>
Date: Thu, 27 Apr 2017 07:17:02 -0700

When investigating http extensions, I came across the `ORIGIN` frame draft here.

Although I think the goals set out for it are good, there are some inherent issues with adding this extension:
- Service exposure on servers: the `ORIGIN` frame will potentially expose previously unknown services on the same host (e.g. administration interfaces on different ports) that should not be advertised.
- Shared-host exposure: the frame will (by design) expose other domains/hosts served by the same server. For shared hosts, this can cause severe privacy issues by exposing which other domains/hosts are served by the same server.
- Origin IP exposure: unless explicitly filtered out, any reverse-proxied connection can expose the origin server's IP to a connecting client, due to the previous point's type of exposure. 
e.g. `example.com` is proxied, `example2.com` is not proxied. Connecting to `example.com` connects to the proxy, exposes `example2.com` also being hosted in the `ORIGIN` frame. Looking up `example2.com` in DNS then exposes the origin IP of `example.com`.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/339