Re: [http-state] Welcome to http-state

> -----Original Message-----
> From: http-state-bounces@ietf.org [mailto:http-state-bounces@ietf.org]
> On Behalf Of Adam Barth
> Sent: Monday, January 12, 2009 4:55 PM
> To: Discuss HTTP State Management Mechanism
> Subject: Re: [http-state] Welcome to http-state

...

> 
> We're asking for integrity against an active network attacker (imagine
> someone who poisons DNS).  The active network attacker can spoof an
> HTTP server on port 443, i.e. http://www.bank.com:443/.  When that
> fake server responds with Set-Cookie2, it can cause the Port attribute
> to be set to 443.

If the user agent truly believes that evil.com is bank.com then all bets
regarding cookie integrity are off - absent an HMAC or something
equivalent. 

> 
> > The receiving server will not be able to detect if a compromised
> secure
> > server clobbered the cookie, but the $Origin field I am suggesting
> should
> > handle that as long as the receiving server itself hasn't been
> compromised.
> 
> Yes, the Origin attribute should fix the issue as long as it includes
> the scheme (and not just the domain and port).
> 

I agree with Adam and Yngve regarding the Origin attribute. The only
things I would add are:

	1. The user agent must not leverage information provided to it
from the server when constructing the Origin value. 
	2. The user agent must not derive the scheme from the port
number.

Blake
_______________________________________________
http-state mailing list
http-state@ietf.org
https://www.ietf.org/mailman/listinfo/http-state