Subject: Re: [httpwg/http-extensions] Potential security issues with ORIGIN frame [origin-frame] (#339)

From: HTTP issue updates <[email-masked]>
Date: Thu, 27 Apr 2017 18:27:40 -0700

Since the ORIGIN frame can only be used for hosts covered by the TLS certificate, how does this make 1 and 3 worse?  All of these can already be seen in the certificate (at least until certificate pushing is defined).  For the second point, that may be worth calling out in Security Considerations that giving ORIGINs for specific names which are covered by a broader wildcard certificate may expose information about the server to the client (albeit intentionally on the server's behalf).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/339#issuecomment-297882873

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 27 Apr 2017 19:03:27 -0700

The first is an issue because it exposes port numbers. Stuff you can otherwise only garner from port scanning (which any IDS will easily catch and halt)
The other points are worse because it provides direct confirmation that the hosts covered are _actively_ running on the same machine. That is crucial information and lead to discovery of information a server operator may not want exposed. Certificates often cover more hosts than are running on servers, but the origin frame will actually confirm which hosts are running on which servers; and as said, can indirectly lead to origin IP discovery (making the server more effectively targetable for DoS attacks, bypassing a CDN, for example)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/339#issuecomment-297887359

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 27 Apr 2017 19:08:10 -0700

I don't get this.  Why would a server advertise something that it doesn't want to advertise?  This is entirely voluntary for servers.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/339#issuecomment-297888012

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 27 Apr 2017 19:12:22 -0700

Let me ask you this then: does it offer granular control over exactly which hosts are being advertised in this frame on a multi-homed server with a broadly-covering certificate?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/339#issuecomment-297888573

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 27 Apr 2017 19:19:21 -0700

yes - the point of the origin extension is fine grained control of which
origins you wish to advertise on a per connection basis.

On Thu, Apr 27, 2017 at 10:12 PM, Moonchild <[email-masked]>
wrote:

> Let me ask you this then: does it offer granular control over exactly
> which hosts are being advertised in this frame on a multi-homed server with
> a broadly-covering certificate?
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/httpwg/http-extensions/issues/339#issuecomment-297888573>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AAP5s3EU3TOta5aYk4v_ERU20t-0t_wcks5r0UsFgaJpZM4NKR4m>
> .
>

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/339#issuecomment-297889502

---

From: HTTP issue updates <[email-masked]>
Date: Fri, 28 Apr 2017 06:09:45 -0700

Well, considering the following in the document:

> senders are encouraged to include as many origins as practical within a single ORIGIN frame

One would assume that server implementations would use a default set of all active hosts served by the server that are part of the TLS certificate. So as it stands, this fine-grained control will likely not be security-aware unless a server implementation does not make this assumption and requires administrators to specifically indicate which hosts to advertise. The document focuses mainly on client implementations and should be extended to address these concerns for the server side.

Don't get me wrong, there's nothing _inherently_ wrong with the spec, but as the issue title said, there are certainly _potential_ security issues with this extension, depending on how it is implemented and to what level configuration is possible. That should be given some more attention.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/339#issuecomment-297993366

---

From: HTTP issue updates <[email-masked]>
Date: Fri, 28 Apr 2017 06:28:15 -0700

> senders are encouraged to include as many origins as practical within a

ah - that language can be tweaked. It is meant to say "dear servers: you
are encouraged to use as few frames as possible to send your origin set"
(as opposed to one origin per frame).

it isn't meant to influence which origins you decide to advertise.

overall though I think you're right that its worth a sentence in the
security considerations to just say pay attention to what you advertise.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/339#issuecomment-297997574