Re: [hybi] Why redirects are a bad for the security of WebSockets (was Re: Clarify wheter HTTP responses other than 101 are valid)

[Iñaki Baz Castillo <[e-mail]>]

2011/3/28 Adam Barth <[e-mail]>:
> Reading this code, it's quite natural to assume that sending and
> receiving information on socket will actually communicate with
> example.com.  For example, I might send confidential information to
> example.com or rely upon the integrity of information received from
> example.com.  However, if example.com has has an open redirector (as
> is extremely common on the Internet), this assumption is incorrect and
> leads to vulnerabilities.

Let me a question: if you would trust the connection with example.com,
why shouldn't you trust it in case it redirects you to other place?



> Now, we can wring our hands and claim that this sort of issue isn't
> our problem, but it is.  Simply warning folks about these traps in
> Security Considerations is just passing the buck.  Instead, we
> shouldn't add this complexity to WebSockets at this time.  We can
> always change out minds and add support for redirects in the future,
> but we can never remove support once added.

Which is the main advantage/feature HTTP redirections provide? is it
load-balancing? If so, forget the ugly 3XX responses and just add DNS
SRV support to WebSocket protocol.



-- 
Iñaki Baz Castillo
<[e-mail]>