[HASMAT] wrt port numbers - comment 51 bug 495115 (bugzilla.mozilla.org)

[=JeffH <[e-mail]>]

Comment 51    Kai Engert <[e-mail]>      2010-07-13 17:23:36 PDT
https://bugzilla.mozilla.org/show_bug.cgi?id=495115#c51


One more detail which I don't see addressed in the spec yet: port numbers!

IMHO the primary key should not be "host", but "host:port".
Also, what happens if the server choses to issue an redirect to a non-standard
port number?

The current code is hard-coded to always construct STS-host uris to the default
port (-1 = 443).

The current code will fail if a STS-host choses to redirect to

https://www.host.com:444

The current code will do funky things if there are two separate http servers
running on the same host, e.g.

- http://host.com/ (default 80)
and
- http://host.com:8080

This configuration is often used on web servers, where the default port is the
actual server, and the additional port is a web-site-maintenance interface.


Let's say www.site.com is using port 80 for the public web and is used to
redirect to 443.

www.site.com is behind a firewall and won't allow connections to ports other
than 80 and 443 from the outside world.

www.site.com has a plain http maintenance interface on port 8080.

I think with the current code, it's impossible to connect to
http://www.site.com:8080, because our http engine will always catch that
request and redirect to https://www.site.com:443/


If you want to keep it simple, and only address the standard configuration, my
proposal is:

- restrict the redirection to http requests that go to port 80


---
end