Re: [http-state] Welcome to http-state

On Mon, Jan 12, 2009 at 4:21 PM, Yngve N. Pettersen (Developer Opera
Software ASA) <yngve@opera.com> wrote:
> My point about $Port is that if the server used either 'Port=' or
> 'Port="443"' and checks for the $Port whenever the cookie is received, it
> will be able to detect if an unsecure server clobbered it, because that
> server would either have to use 'Port="80,443"', or not use Port at all, to
> be able to set the cookie and to get the cookie sent to the secure server.

We're asking for integrity against an active network attacker (imagine
someone who poisons DNS).  The active network attacker can spoof an
HTTP server on port 443, i.e. http://www.bank.com:443/.  When that
fake server responds with Set-Cookie2, it can cause the Port attribute
to be set to 443.

> The receiving server will not be able to detect if a compromised secure
> server clobbered the cookie, but the $Origin field I am suggesting should
> handle that as long as the receiving server itself hasn't been compromised.

Yes, the Origin attribute should fix the issue as long as it includes
the scheme (and not just the domain and port).

Adam
_______________________________________________
http-state mailing list
http-state@ietf.org
https://www.ietf.org/mailman/listinfo/http-state