Re: [hybi] Redesigning the Web Socket handshake

[Justin Erenkrantz <justin at erenkrantz.com>]

On Tue, Feb 2, 2010 at 9:22 PM, Maciej Stachowiak <mjs at apple.com> wrote:
> Let me start by laying out the security risks in the current handshake. Then I will explain my proposed change and how I believe it addresses them.

Thanks!  For the security stuff, I think it's best if I ponder that
for a few days to see if I can grok where the risks are.  In the
meantime, there is one point that I'd like to ask clarification on:

> To give a concrete example, consider a chat service over WebSocket. Let's say it doesn't check correctness of the handshake, and does authentication in-band. An attacker could construct an HTTP POST body which would look like an authentication message plus a couple of submitted sent messages. True, the attacker cannot read the victim's chat messages, but could send chat messages as the victim. Clearly this would be a significant security breach.

I am trying to understand how a properly implemented WS or HTTP server
would fall into this trap.  For httpd, this would not be feasible -
the code that parses request bodies isn't the same that handles the
protocol.  I'm trying to think of any real server implementations that
would attempt to process an HTTP body that also includes "fake"
requests (but in a different protocol).  Maybe there's a bit of
crafting that I'm just not seeing...

> We could mitigate both of these risks, and also reduce the implementation difficulty for servers and proxies, by changing the handshake. We would remove the requirement for newlines or exact capitalization of the headers. Instead, we could have the browser generate a unique random nonce, which it includes in the handshake request. The server would be required to read it, and respond with a hash of the nonce value.

While I'm not 100% sold on the security rationale for nonce yet (still
pondering it), at the least, the nonce is pretty straightforward to
implement - so, I could certainly be willing to admit I have a blind
spot there and go with the nonce if it means I can implement this in
httpd in an otherwise-straightforward manner.

Thanks again.  -- justin