Re: [Doh] DOH and Induced DNS

[Adam Roach <[e-mail]>]

On 11/6/17 5:32 PM, Mark Nottingham wrote:
>
>> On 7 Nov 2017, at 4:07 am, dagon <[e-mail]> wrote:
>>
>>   c) Header-only?  If we assume implementation mistakes will always
>> occur in DOH stubs and recursives, perhaps the wire encoding should
>> appear only in HTTP headers, since these are less easily manipulated
>> by crafted javascript and HTML.  At the same time, the headers are
>> presumably within reach of the stub.  Header fields seem more likely
>> to reflect browser user decisions, and not the HTML author's malicious
>> whims.  (At least the problem would only be as bad as DNS prefetch, in
>> terms of volume.)
> It's trivial for scripts to modify headers, EXCEPT those starting with Sec-:
>    https://fetch.spec.whatwg.org/#forbidden-header-name
>
> If this is a concern, it might be workable to define a header that looks something like:
>
> Sec-Doh: 1
>
> to indicate that the request was generated by the browser / client internals, not script.

If the notion here is to prevent JS-initiated queries, I'll point out 
that this is explicitly prohibited by the working group charter: "While 
access to DNS-over-HTTPS servers from JavaScript running in a typical 
web browser is not the primary use case for this work, precluding the 
ability to do so would require additional preventative design. The 
working group will not engage in such preventative design."

/a