Re: [quicwg/base-drafts] Document request forgery (#3996)

[Igor Lubashev <[e-mail]>]

@igorlord commented on this pull request.



> +
+The most effective defense against request forgery attacks is to modify
+vulnerable services to use strong authentication. However, this is not always
+possible when deploying QUIC. This section outlines some others steps that QUIC
+endpoints could take. These additional steps are all discretionary as,
+depending on circumstances, they could interfere with or prevent legitimate
+uses.
+
+Services offered over loopback interfaces (that is, ::1 or 127.0.0.1) often
+lack proper authentication. Endpoints MAY prevent connection attempts or
+migration to a loopback address. Endpoints SHOULD NOT allow connections or
+migration to a non-loopback address if the same service was previously
+available over a different interface or the address was provided by a service
+at a non-loopback address. Endpoints that depend on these capabilities could
+offer an option to disable these protections.
+

@huitema This is certainly a way to mount an attack on services that assume that they are serving friendly clients and the network perimeter is secure.  It happens, especially when services listen only on RFC1918/unique-local or link-local IPs.  It happens even more often with services only listen to loopback and, therefore, think they are immune to any threats coming from outside of the host.

That's why I'd generalize this from "non-loopback -> loopback" to “globally routable IP space” -> “RFC1918/unique-local IP space” -> “link-local” -> “loopback”.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3996#discussion_r470891533