IETF Logo Mail Archive

Re: Linking a cookie to an IP address is a very bad in 2015...

Michael Sweet <msweet@apple.com> Thu, 02 April 2015 17:03 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9860A1ACEB0 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Thu, 2 Apr 2015 10:03:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.202
X-Spam-Level:
X-Spam-Status: No, score=-6.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, J_CHICKENPOX_52=0.6, RCVD_IN_DNSWL_HI=-5, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YFGdz7GfkIMI for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Thu, 2 Apr 2015 10:03:14 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43C2A1ACE9E for <httpbisa-archive-bis2Juki@lists.ietf.org>; Thu, 2 Apr 2015 10:03:08 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1YdiTf-0005sA-RN for ietf-http-wg-dist@listhub.w3.org; Thu, 02 Apr 2015 17:00:23 +0000
Resent-Date: Thu, 02 Apr 2015 17:00:23 +0000
Resent-Message-Id: <E1YdiTf-0005sA-RN@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtp (Exim 4.80) (envelope-from <msweet@apple.com>) id 1YdiTc-0005X5-2f for ietf-http-wg@listhub.w3.org; Thu, 02 Apr 2015 17:00:20 +0000
Received: from mail-out5.apple.com ([17.151.62.27] helo=mail-in5.apple.com) by maggie.w3.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.72) (envelope-from <msweet@apple.com>) id 1YdiTa-0000ey-Ln for ietf-http-wg@w3.org; Thu, 02 Apr 2015 17:00:20 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=apple.com; s=mailout2048s; c=relaxed/simple; q=dns/txt; i=@apple.com; t=1427993991; x=2291907591; h=From:Sender:Reply-To:Subject:Date:Message-id:To:Cc:MIME-version:Content-type: Content-transfer-encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-reply-to:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=ucTmahKMeZ/WXDO151CYrcV6Mv9E7bP1ZHLL0JZJD8I=; b=ekZUB+y7wHXL60AvnGkO3pn3u0b2kzhg/bXTAw01JNlhSX+F1N4tlU74YEBt3oPL RYMDb5LzlAirBfNddxZtWSv24HgRRPupSWd+LXNRKE/8gFpqHpm4k76OkQt+U4OV hqUmkdmWLDK/jw3nFJ9Z9FrFIblRcj0sTrSQFqvYHsE+kgPCrI6nlIJ4gMei5rah AMZzGHIsp9bv2JESXZudMKPybEdXGSNd1m6MOfG4GofmZ1/BYEZg1eHS9YOLOTRu /7iYlPqkkp4jYm42eaz5WbDzsADj0yg5LpM2t3fFbD5ro+8j7dIuLjeymWdDw8Pq SvSlFb/E9FyPJz6D0acCcQ==;
Received: from relay3.apple.com (relay3.apple.com [17.128.113.83]) by mail-in5.apple.com (Apple Secure Mail Relay) with SMTP id 37.61.12430.7857D155; Thu, 2 Apr 2015 09:59:51 -0700 (PDT)
X-AuditID: 11973e13-f79d56d00000308e-06-551d75872d4b
Received: from spicerack.apple.com (spicerack.apple.com [17.128.115.40]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by relay3.apple.com (Apple SCV relay) with SMTP id 3C.80.19589.F857D155; Thu, 2 Apr 2015 09:59:59 -0700 (PDT)
Received: from [17.153.100.72] by spicerack.apple.com (Oracle Communications Messaging Server 7.0.5.30.0 64bit (built Oct 22 2013)) with ESMTPSA id <0NM600G7WV7PQD00@spicerack.apple.com> for ietf-http-wg@w3.org; Thu, 02 Apr 2015 09:59:51 -0700 (PDT)
MIME-version: 1.0 (Mac OS X Mail 8.2 \(2095\))
Content-type: text/plain; charset="utf-8"
From: Michael Sweet <msweet@apple.com>
In-reply-to: <CACuKZqHDru45jcZiDt91gVtrTZZqJJ2XaK6k0XVKK0R4nCciFg@mail.gmail.com>
Date: Thu, 02 Apr 2015 12:59:48 -0400
Cc: "Eric Vyncke (evyncke)" <evyncke@cisco.com>, "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
Content-transfer-encoding: quoted-printable
Message-id: <9883E896-F9B0-4E16-ADF5-B0B1893058C8@apple.com>
References: <D141A3E5.4146E%evyncke@cisco.com> <CACuKZqHDru45jcZiDt91gVtrTZZqJJ2XaK6k0XVKK0R4nCciFg@mail.gmail.com>
To: Zhong Yu <zhong.j.yu@gmail.com>
X-Mailer: Apple Mail (2.2095)
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrPLMWRmVeSWpSXmKPExsUi2FAYrNteKhtqcOGsscXhlllMDoweR+ft Zw1gjOKySUnNySxLLdK3S+DKWL/qOXvBcZ6KX9+a2BoYp3F1MXJySAiYSFw8+4wdwhaTuHBv PVsXIxeHkMBeRolrrbdZYIo+NGxlgUhMZpLom/kKyvnPKPH67AtGkCphAXeJ3ytmMoPYvAJ6 Eo9azgAVcXAwC6hLTJmSCxJmE1CT+D2pjxXE5hQIlvj1ej5YK4uAqsSczrOMEOVxEq8O64KE mQW0JZ68u8AKEuYVsJE4+Z0NJCwkUCpxon8aE4gtIqAscezmMiaIM2Uleo/PZwa5TELgI6vE z21z2ScwCs9CctAshINmIdmwgJF5FaNQbmJmjm5mnqleYkFBTqpecn7uJkZQCE+3E97BeHqV 1SFGAQ5GJR7ejD0yoUKsiWXFlbmHGKU5WJTEeROlpUOFBNITS1KzU1MLUovii0pzUosPMTJx cEo1ME4/PbtQab3klO2ND5/+ODWr2cla6Zg3lxtrdeeSoxcajnoL/l/3640N34m9bpGnPwtp rtjvd1qR223S+YboHub5n/UO75pxdiZ7zeEt56/EBty8tmfjvORp4R/eLmTy0hD/Wly/vUUl XS04ufyt6Z8NK5d8SOtK1WVnWXi8NVOQq+h134vyS0FKLMUZiYZazEXFiQCfWw3DQgIAAA==
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrELMWRmVeSWpSXmKPExsUi2FCsodtfKhtq8O2ikMXhlllMDoweR+ft Zw1gjOKySUnNySxLLdK3S+DKWL/qOXvBcZ6KX9+a2BoYp3F1MXJySAiYSHxo2MoCYYtJXLi3 nq2LkYtDSGAyk0TfzFcsEM5/RonXZ18wglQJC7hL/F4xkxnE5hXQk3jUcgaoiIODWUBdYsqU XJAwm4CaxO9JfawgNqdAsMSv1/PBWlkEVCXmdJ5lhCiPk3h1WBckzCygLfHk3QVWkDCvgI3E ye9sIGEhgVKJE/3TmEBsEQFliWM3lzFBnCkr0Xt8PvMERoFZSG6YhXDDLCRDFzAyr2IUKErN Saw01kssKMhJ1UvOz93ECA65wuAdjH+WWR1iFOBgVOLhzdgjEyrEmlhWXJl7iFGCg1lJhFcr TTZUiDclsbIqtSg/vqg0J7X4EKM0B4uSOK9DOFBKID2xJDU7NbUgtQgmy8TBKdXAWGaz+fys fUK9epWyUx+5rXM+3/Nz506TAjsJn7AlN8zalx88dn92dqSzaqeC7UST9Sf2ra4y/j7p8dvb 6c+yz+1eumnOzupJ2UxL/PS8Twu7aW+ZXMY4weKOx0yJj4kqc9e6BxorTw/f8FY50vxIrrZz Of9UdqVnG7kV5KqcO77FRm4sObzJR4mlOCPRUIu5qDgRAKtbVdI1AgAA
Received-SPF: pass client-ip=17.151.62.27; envelope-from=msweet@apple.com; helo=mail-in5.apple.com
X-W3C-Hub-Spam-Status: No, score=-5.7
X-W3C-Hub-Spam-Report: AWL=-0.489, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, T_RP_MATCHES_RCVD=-0.01, W3C_AA=-1, W3C_DB=-1, W3C_WL=-1
X-W3C-Scan-Sig: maggie.w3.org 1YdiTa-0000ey-Ln d997e6b16e9839f68ff5205b313e9f6b
X-Original-To: ietf-http-wg@w3.org
Subject: Re: Linking a cookie to an IP address is a very bad in 2015...
Archived-At: <http://www.w3.org/mid/9883E896-F9B0-4E16-ADF5-B0B1893058C8@apple.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/29223
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

HTTPS does not guarantee that the connection stays up forever or that there is only one connection, particularly for HTTP/1.1 but even for HTTP/2 it isn't a "safe" assumption.


> On Apr 2, 2015, at 12:11 PM, Zhong Yu <zhong.j.yu@gmail.com> wrote:
> 
> A TLS session is a pretty good alternative. Within one browser
> session, different HTTPS connections to the same server will likely
> share the same TLS session. The server can bind state to the TLS
> session; there's no need for an HTTP cookie, if the site is HTTPS
> only.
> 
> Zhong Yu
> bayou.io
> 
> 
> 
> On Wed, Apr 1, 2015 at 6:32 AM, Eric Vyncke (evyncke) <evyncke@cisco.com> wrote:
>> In the era of scarce IPv4 addresses, servers should NOT link the HTTP
>> session cookies to the user-agent IP address...
>> 
>> I have posted in the IETF V6OPS WG the following:
>> http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-6.pdf
>> https://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie
>> 
>> In short, heavy use of NAT and/or dual-stack (IPv4/IPv6) can cause a change
>> of user-agent address => lost of session.
>> 
>> Any suggestion on how this can be addressed? I know at least two major web
>> sites in Belgium that removed IPv6 from their web site due to this issue
>> (and their security department not wanting to unlink IP address from the
>> session cookies)
>> 
>> Comments are welcome
>> 
>> -éric
>> 
> 

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair

v2.23.0 | Report a Bug | By Email