Re: [hybi] Handshake was: The WebSocket protocol issues.

[Adam Barth <[e-mail]>]

On Mon, Oct 11, 2010 at 10:53 AM, Scott Ferguson <[e-mail]> wrote:
> Bjoern Hoehrmann wrote:
>> * Scott Ferguson wrote:
>>> The target is pre-compromised because it has an open DELETE (point #6)
>>> and the target is pre-compromised because it's on the same machine as the
>>> attacker (point #1).
>>
>> You are misunderstanding the example trace I gave. The DELETE is sent to
>> the attacker, not the target. The server 1.2.3.4 needs to think that the
>> client is still talking HTTP, and if the first thing it sees is "ħ<" or
>> something like that, it might respond with an error message and close
>> the connection. "DELETE..." in US-ASCII looks like a Websocket text
>> frame and like HTTP, so I am using that as an example. If the attacker
>> manages to create the initial frames such that the web server keeps the
>> connection open, then he can send pretty much arbitrary HTTP requests to
>> the target server.
>>
>
> The "DELETE" represents the HTTP request that a normal browser cannot
> produce but the WebSocket request supposedly can.
>
> The point is, a server cannot rely on browser restrictions to protect their
> HTTP site. It must defend itself against arbitrary clients which are
> perfectly capable of sending arbitrary, perfectly valid requests.
>
> The attempt to avoid that server-side responsibility by using an IP
> restriction to a foreign site (the office) is not any kind of real defense.

I encourage you to read the archives of the W3C webapps working group.
 These issues were discussed in great depth when we were working on
CORS and UMP.  The consensus was that these things were worth worrying
about and the resultant protocols, both as specced and as implemented,
defend against these threats.  In that case, defending against these
threats was actually somewhat costly, unlike here where's it's quite
cheap.

Adam