Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Bjoern Hoehrmann wrote:
> * Scott Ferguson wrote:
>   
>> And even if this were all possible, the browser could now ...
>>
>> ... wait for it ...
>>
>> ... make HTTP requests to a HTTP server using websockets instead of the 
>> browser's HTTP client.
>>     
>
> By now there are quite a number of handshake proposals floating around,
> but if a single response is sufficient to make the web browser consider
> the connection to have been upgraded to a Websocket connection, and the
> framing allows to make frames that look like HTTP requests, and last I
> checked "DELETE..." was a properly formed frame (though that relied on
> the browser setting a flag that is currently reserved), then this setup
> would allow attackers do to things they currently cannot do, as browsers
> excercise considerable control over what requests a possibly malicious
> web site can trigger for an unrelated site.
>   

Your attacker's PHP script is perfectly capable of launching a 
non-browser attack against the target server. It's not true at all that 
a HTTP request is one of the "things they currently cannot do". Can you 
explain why the attacker doesn't just launch a trivial non-browser 
attack from the PHP script?

To clarify, the target has the following vulnerabilities:

  1. It has a DELETE method available to any non-browser client on the 
internet.
  2. It has no authentication for that DELETE.

This authentication issue, by the way, is why I want a place for 
authentication in the WebSocket handshake. Since servers do need to 
protect themselves against non-browser clients, and will provide 
non-browser services, they need the ability to defend themselves against 
any attacker on the web who opens a TCP socket.

-- Scott