Re: [HASMAT] wrt port numbers - comment 51 bug 495115 (bugzilla.mozilla.org)

[Adam Barth <[e-mail]>]

On Mon, Jul 19, 2010 at 12:49 AM, Kai Engert <[e-mail]> wrote:
> On 17.07.2010 02:29, Adam Barth wrote:
> Here's the response I gave on the bug:
>
> [[
> With respect to port numbers, I think that's not well covered in the spec.
> The
> way it works in chrome is that the STS state is for the whole host (this is
> important to protect secure cookies, which are shared by the whole host).
> For
> the redirect behavior: port numbers are preserved except port 80 is changed
> to
> port 443 because 80 is the default port for http.
> ]]
>
> If you want to keep it simple, and only address the standard configuration,
> my
> proposal is:
>
> - restrict the redirection to http requests that go to port 80
>
> That's not a good idea.  It's an importnat security property that the
> browser never issues an HTTP request for hosts with STS enabled.  The
> reasons for this are somewhat subtle and revolve around deficiencies
> in the cookie protocol.  Essentially, because cookies do not have
> integrity, you want to rule out the possibility of an active network
> attacker responding to such requests with a Set-Cookie header.
>
> Another way of thinking about the situation is as follows:
>
> 1) An STS server is promising never to use HTTP or send broken certificates.
> 2) If we're trying to issue an HTTP request to example.com:8080, then
> that's not what example.com wants and we shouldn't do it.
>
> Adam
>
> Let me try to summarize your proposed behaviour:
>
> plain http is forbidden for all ports on a known HSTS host
> (it's not possible to run any additional http services on a known HSTS host,
> because HSTS-compliant browsers are expected to never connect to it)
> a browser is expected to catch http://host:80 requests and transfer them
> into https://host:443
> http to any port other than 80 gets changed into https to the same port
> number, e.g. the browser must change requests to http://host:81 into
> requests for https://host:81
>
> Is my understanding right?

Yes, precisely.

Adam