Re: [secdir] secdir review of draft-ietf-httpbis-tunnel-protocol-04

[Scott Kelly <[e-mail]>]

On Jun 10, 2015, at 1:02 PM, Martin Thomson <[e-mail]> wrote:

> On 10 June 2015 at 12:09, Scott Kelly <[e-mail]> wrote:
>> 
>> +          A proxy can use the value of the ALPN header field as input to
>> +          authorization decisions.  The header field exposes protocol
>> +          information at the HTTP layer, allowing authorization decisions to be
>> +          made earlier, with better error reporting (such as a 403 status code).
>> 
>> The term “authorization” evokes notions of security, at least for me. This text gives me the impression that the ALPN header is suitable for use in security decisions.
>> 
>> I can think of a couple of ways to address this. One easy way is to replace “authorization” with something more security-neutral (“filtering”? “allow/deny”?). Another is to simply add a statement saying this header may be falsified by either the client or a MitM, and therefore should not be relied upon for security-relevant decisions unless additional security measures are applied.
> 
> 
> Would it make more sense like this?
> 
>          A proxy can use the value of the ALPN header field to more cleanly and
>          efficiently reject requests for a CONNECT tunnel.  Exposing protocol
>          information at the HTTP layer allows a proxy to deny requests earlier,
>          with better error reporting (such as a 403 status code).  The ALPN
>          header field can be falsified and is therefore not sufficient basis
>          for authorizing a request.

Yes.

Thanks,

Scott