Re: [hybi] Handshake was: The WebSocket protocol issues.

[Adam Barth <[e-mail]>]

On Fri, Oct 8, 2010 at 5:00 PM, Bjoern Hoehrmann <[e-mail]> wrote:
> * Scott Ferguson wrote:
>>So the attacker has a PHP script running on the same physical machine as
>>the target site, on the same VM guest as the target, and using the same
>>shared web server as the target, and has decided that a cross protocol
>>attack is the appropriate vector against a target on the same machine as
>>his PHP script.
>
> In the scenario the browser thinks it is talking Websocket while the
> server thinks the browser is talking HTTP, so basically
>
>  +----------------+                    +------------------+
>  | User's browser | -- "Websocket" +-- | attacker.example |
>  +----------------+                |   +------------------+
>                                  HTTP
>                                    |   +------------------+
>                                    +-- | target.example   |
>                                        +------------------+
>
> How attacker.example and target.example are organized is up to the
> web server, it could just be some kind of firewall where the two sites
> are actually hosted on physically separate machines behind it and they
> may be unable to talk to each other. I do think this is something that
> the Websocket protocol needs to address.

Yes, precisely.  The proposal I sent recently addresses this issue by
putting the virtual host dispatch information in a place that's only
visible to a server that understands WebSockets.  That way we know
it's making an informed decision about accepting the handshake.

Adam