Re: [HASMAT] wrt port numbers - comment 51 bug 495115 (bugzilla.mozilla.org)

[Adam Barth <[e-mail]>]

On Sat, Jul 17, 2010 at 9:34 AM, Devdatta Akhawe <[e-mail]> wrote:
>> That's not a good idea.  It's an importnat security property that the
>> browser never issues an HTTP request for hosts with STS enabled.  The
>> reasons for this are somewhat subtle and revolve around deficiencies
>> in the cookie protocol.  Essentially, because cookies do not have
>> integrity, you want to rule out the possibility of an active network
>> attacker responding to such requests with a Set-Cookie header.
>
> It seems to me that this should be fixed by STS. Would something like
> 'once STS is enabled a STS server shouldn't allow HTTP to set secure
> cookies' (in better language) be enough? I am not really sure what are
> the attacks you are referring to.

That's already true because the browser never issues HTTP requests to
an STS host and therefore can never receive an HTTP response
containing a Set-Cookie header.

More generally, there are tons of random semantics we could layer onto
the STS bit.  However, that leads to a complex feature that's hard for
sites to reason about and deploy.  Instead, it's better to stick with
a couple hard-working primitives, which is what the current design
aims for.

Adam