Re: [HASMAT] wrt port numbers - comment 51 bug 495115 (bugzilla.mozilla.org)

Here's the response I gave on the bug:

[[
With respect to port numbers, I think that's not well covered in the spec.  The
way it works in chrome is that the STS state is for the whole host (this is
important to protect secure cookies, which are shared by the whole host).  For
the redirect behavior: port numbers are preserved except port 80 is changed to
port 443 because 80 is the default port for http.
]]

> If you want to keep it simple, and only address the standard configuration,
> my
> proposal is:
>
> - restrict the redirection to http requests that go to port 80

That's not a good idea.  It's an importnat security property that the
browser never issues an HTTP request for hosts with STS enabled.  The
reasons for this are somewhat subtle and revolve around deficiencies
in the cookie protocol.  Essentially, because cookies do not have
integrity, you want to rule out the possibility of an active network
attacker responding to such requests with a Set-Cookie header.

Another way of thinking about the situation is as follows:

1) An STS server is promising never to use HTTP or send broken certificates.
2) If we're trying to issue an HTTP request to example.com:8080, then
that's not what example.com wants and we shouldn't do it.

Adam

On Fri, Jul 16, 2010 at 12:20 PM, =JeffH <Jeff.Hodges@kingsmountain.com> wrote:
>
> Comment 51    Kai Engert <kaie@kuix.de>      2010-07-13 17:23:36 PDT
> https://bugzilla.mozilla.org/show_bug.cgi?id=495115#c51
>
>
> One more detail which I don't see addressed in the spec yet: port numbers!
>
> IMHO the primary key should not be "host", but "host:port".
> Also, what happens if the server choses to issue an redirect to a
> non-standard
> port number?
>
> The current code is hard-coded to always construct STS-host uris to the
> default
> port (-1 = 443).
>
> The current code will fail if a STS-host choses to redirect to
>
> https://www.host.com:444
>
> The current code will do funky things if there are two separate http servers
> running on the same host, e.g.
>
> - http://host.com/ (default 80)
> and
> - http://host.com:8080
>
> This configuration is often used on web servers, where the default port is
> the
> actual server, and the additional port is a web-site-maintenance interface.
>
>
> Let's say www.site.com is using port 80 for the public web and is used to
> redirect to 443.
>
> www.site.com is behind a firewall and won't allow connections to ports other
> than 80 and 443 from the outside world.
>
> www.site.com has a plain http maintenance interface on port 8080.
>
> I think with the current code, it's impossible to connect to
> http://www.site.com:8080, because our http engine will always catch that
> request and redirect to https://www.site.com:443/
>
>
> If you want to keep it simple, and only address the standard configuration,
> my
> proposal is:
>
> - restrict the redirection to http requests that go to port 80
>
>
> ---
> end
>
>
>
> _______________________________________________
> HASMAT mailing list
> HASMAT@ietf.org
> https://www.ietf.org/mailman/listinfo/hasmat
>