Re: [HASMAT] wrt port numbers - comment 51 bug 495115 (bugzilla.mozilla.org)

[Kai Engert <[e-mail]>]

  On 17.07.2010 02:29, Adam Barth wrote:
> Here's the response I gave on the bug:
>
> [[
> With respect to port numbers, I think that's not well covered in the spec.  The
> way it works in chrome is that the STS state is for the whole host (this is
> important to protect secure cookies, which are shared by the whole host).  For
> the redirect behavior: port numbers are preserved except port 80 is changed to
> port 443 because 80 is the default port for http.
> ]]
>
>> If you want to keep it simple, and only address the standard configuration,
>> my
>> proposal is:
>>
>> - restrict the redirection to http requests that go to port 80
> That's not a good idea.  It's an importnat security property that the
> browser never issues an HTTP request for hosts with STS enabled.  The
> reasons for this are somewhat subtle and revolve around deficiencies
> in the cookie protocol.  Essentially, because cookies do not have
> integrity, you want to rule out the possibility of an active network
> attacker responding to such requests with a Set-Cookie header.
>
> Another way of thinking about the situation is as follows:
>
> 1) An STS server is promising never to use HTTP or send broken certificates.
> 2) If we're trying to issue an HTTP request to example.com:8080, then
> that's not what example.com wants and we shouldn't do it.
>
> Adam

Let me try to summarize your proposed behaviour:

    * plain http is forbidden for all ports on a known HSTS host
      (it's not possible to run any additional http services on a known
      HSTS host, because HSTS-compliant browsers are expected to never
      connect to it)
    * a browser is expected to catch http://host:80 requests and
      transfer them into https://host:443
    * http to any port other than 80 gets changed into https to the same
      port number, e.g. the browser must change requests to
      http://host:81 into requests for https://host:81

Is my understanding right?

Thanks,
Kai