Re: [hybi] Upgrade Mechanism and HasMat (was Re: Extensibility mechanisms?)

[Salvatore Loreto <[e-mail]>]

On 7/22/10 12:33 PM, Roy T. Fielding wrote:
> On Jul 22, 2010, at 1:21 AM, Salvatore Loreto wrote:
>
>    
>> I see more value to work on a general solution to secure the HTTP Upgrade mechanism
>> against cross-protocol vulnerability, instead of trying to draft something ad-hoc for WebSocket
>>      
> The HTTP Upgrade mechanism is not vulnerable to cross-protocol attacks.
> Other (non-HTTP) services are vulnerable to browser misdirection if
> the browser can be directed to send arbitrary bytes to an arbitrary
> TCP port.  That is a problem which HTTP is actually good at avoiding
> because the first line is unique to HTTP.
>    
Hi Roy,

thanks for the answer and to share your view.
as far I understood (but I have to admit not to be an expert on 
cross-protocol attacks),
the kind of attacks people are talking is restrict to HTTP - WebSocket 
(or viceversa) cross attack.

however if HTTP experts exclude any vulnerability in the HTTP Upgrade,
then a sort of security check right after the end of the Upgrade from 
HTTP to Websocket
and before the WebSocket starts to exchange data, could solve the problem.

> The issues people are raising about Upgrade are in regard to passing
> through intermediaries.  Some people believe that intermediaries are
> evil and must be tunneled through.  Other people believe that
> intermediaries are beneficial and any protocol that deliberately
> subverts them will be blocked.
>    
passing or not through intermediaries is a completely different protocol 
aspect the wg has make a decision on;
but I would prefer the decision be made clearly, not hidden behind 
security issues
especially if they do not exist !

cheers
/Sal
> There is no solution that will satisfy both of those beliefs.
> Please stop trying to reconcile irreconcilable belief systems.
>    
> Implement both.  One will succeed, the other will fail.
> Neither choice is mature enough for standardization at the
> current time.
>
> ....Roy
>
>
>    


-- 
Salvatore Loreto
www.sloreto.com