Re: [hybi] Why redirects are a bad for the security of WebSockets (was Re: Clarify wheter HTTP responses other than 101 are valid)

[Adam Barth <[e-mail]>]

On Mon, Mar 28, 2011 at 3:38 PM, Patrick McManus <[e-mail]> wrote:
> Hi Adam, I really appreciate you spelling this out - it helps the WG.
>
> On 3/28/11 10:34 PM, Adam Barth wrote:
>> example.com.  However, if example.com has has an open redirector (as
>> is extremely common on the Internet), this assumption is incorrect and
>> leads to vulnerabilities.
>
> I know you won't agree, but for the wg list I don't see how this expands the
> threat model when compared to all the other bugs and vulnerabilities that
> might be present (or not) on example.com when we interact with it. I'm not
> saying its not our problem, I'm just saying it is more or less par for level
> of vulnerability we already have by connecting to that host.

Yeah, I don't agree.  People like to complain about open redirectors,
but the reality is that the vast majority of non-trivial web sites
contain them and don't feel a need to close them.  The situation is
quite unlike XSS, which sites actively worry about and repair.

> There are auth patterns using redirect that I think would be useful to
> support. The websockets API wont be able to pass the redir info to the JS on
> failure so we can't just bump the issue out. Plus I think having a full
> fledged http bootstrap without caveat and exception is a good thing from a
> modeling point of view for a lot of the same reasons I think masking the
> whole client->server request stream is a better model.

That's all fine and good, but we don't need to address those use cases
in the first iteration of the protocol.  If these turn out to be
pressing issues that can't be addressed satisfactory at the
application layer, then we can revisit this question.  Anything else
is premature.

I also don't buy your argument about simplifying the model by
increasing complexity.  Adding complexity does not improve security.

Adam