Re: [quicwg/base-drafts] address-based access control (#2279)

[Martin Thomson <[e-mail]>]

Marking editorial because I don't see a concrete change as a result of this, more likely just advice, but this could flip.

One of the greatest pieces of baggage in HTTP is source-address-based ACLs.  I understand their value in DoS mitigation, but this issue implies something greater than that.  I hope that you don't mean as a substitute for authentication, but more part of a more comprehensive "your IP address is bad and you should feel bad, so here's a 4xx/5xx".

If we are talking about reputation for DoS mitigation, and a connection on a "good" address moves to a "bad" address, I would probably recommend against a change in treatment in all but extreme cases.

If you are using IP address as a proxy for physical location - which is a bad idea in general, but might be justifiable in terms of defense-in-depth strategies for high-value resources under conditions you control.  If your client moved outside that area, then you will need to consult your local policy.  Some policies could say "don't accept the packets", which is the most robust response, but it makes the HTTP status code somewhat irrelevant.  Clients in those contexts will want to be locked to the one network interface somehow.

The question is whether we might want to help the client avoid accidental address changes with an explicit signal.  I'm going to suggest that the answer is "no".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2279#issuecomment-450612881