Re: [quicwg/base-drafts] The method of identifying "the same server" (#3155)

[Kazuho Oku <[e-mail]>]

IIRC, @martinthomson pointed out that the scope of tokens should be as tight as that of the session tickets (i.e. option c), due to the following reason.

Consider the case of a split-server deployment (i.e. a gateway with a single IP address mapping connections to different QUIC servers in the backend, based on SNI). If we are to adopt option a or option b, one of those backend servers might issue a token, that would then be used by the client when connecting to a different backend server that shares the same gateway. This means that the party controlling the server that issued the token can see that the same client connected to a different server, assuming that the party can observe the traffic that goes into the load balancer.

To avoid the leak, the scope of NEW_TOKEN tokens should be at most the set of the server-names that the issuer of the token is authoritative for; which means option c.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3155#issuecomment-546789506