Re: [hybi] Upgrade Mechanism and HasMat (was Re: Extensibility mechanisms?)

[Maciej Stachowiak <[e-mail]>]

On Jul 22, 2010, at 1:21 AM, Salvatore Loreto wrote:

> Hi Adam,
> 
> first let me thank you, Willy, Maciej  for the discussion about cross-protocol vulnerability,
> having the explanation and picture of the problem always help the discussion and boost the
> possibility to find a good solution.
> 
> from my personal point of view,
> I see more value to work on a general solution to secure the HTTP Upgrade mechanism 
> against cross-protocol vulnerability, instead of trying to draft something ad-hoc for WebSocket
> 
> actually that sounds at least to me as something that perfectly fit in the HasMat BoF.
> 
> "The goal of this working group is to standardize a small number of
> selected specifications that have proven to improve security of Internet
> Web applications. The requirements guiding the work will be taken from
> the Web application and Web security communities.
> It would be extremely good if you (or someone else) can arrange a short presentation about this issue during the HasMat BoF!
> If nobody volunteer I can prepare a couple of slides (taking advantage of what you have discussed in this thread)
> and ask 5 minutes to the HasMat chairs to present them.

I'm not sure that is a good approach to the problem, for two reasons:

1) Cross-protocol vulnerabilities are highly dependent on the details, and it matters very much what the upgrade request looks like, and what protocol is used after upgrading. Upgrading to WebSocket has very different considerations from upgrading to TLS (RFC2817). It's not clear to me that this problem can be solved in a generic way.

2) Even if the problem could be solved generically for any instance of HTTP Upgrade, it would create significant delay if we add a dependency to WebSocket Protocol on a dependency that is currently undefined.

Regards,
Maciej