Re: [Unbearable] on not listing 'Sec-Token-Binding' in the Connection header field?

[Amos Jeffries <[e-mail]>]

On 10/02/2017 7:18 a.m., Andrei Popov wrote:
> Hi Jeff,
> 
> If you agree that the client, generally, does not know whether the proxy/TLS terminator validates TB or passes it on to the back-end server, then why do you argue that the client should require the proxy to drop TB headers? I believe the client should not interfere with this and let datacenter infrastructure figure out how/where to handle TB headers.
> 
>> ..which is what we want by default for security considerations reasons, I think.
> Sorry, what security considerations reasons are you referring to?
> 

* Leaking the TB values from TLS terminating proxies. *unless* they are
intentionally non-validating reverse-proxies.

* to be sure the Sec-Token-Binding actually belongs to the TLS
connection the HTTP message was transmitted over. Not being injected by
an attacker.

* to pevent multiple Sec-Token-Binding being delivered on a message if
there happened to be multiple different TLS hops along the way. To
ensure attackers can't just send multiple TBH and hope one gets accepted.

Amos