[hybi] Concerns about Origin

"Simon Pieters" <simonp@opera.com> Mon, 22 November 2010 13:07 UTC

Content-Type: text/plain; charset="utf-8"; format="flowed"; delsp="yes"
To: "hybi@ietf.org" <hybi@ietf.org>
Date: Mon, 22 Nov 2010 14:08:35 +0100
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
From: Simon Pieters <simonp@opera.com>
Message-ID: <op.vmkpgllmidj3kv@simon-pieterss-macbook.local>
User-Agent: Opera Mail/10.63 (MacIntel)
Subject: [hybi] Concerns about Origin
Precedence: list

One thing I'm concerned about with websockets is that most generic  
websocket servers seem to just echo the Origin value in  
Sec-WebSocket-Origin without giving an obvious way for the app writer to  
restrict which Origins to allow, let alone making it clear to the app  
writer that it is his responsibility to restrict connections from  
different origins.

So people might assume that "websockets uses origin-based security model"  
and go ahead and assume that the browser will disallow connections from  
other origins.

I think the spec should be even clearer that it is the server's  
responsibility to restrict connections from unwanted origins, and that  
browsers will happily attempt to connect to cross-origin websocket  
servers, which in practice will lead to sites being trivially vulnerable  
to attacks from other Web pages. I think it might be good to suggest that  
generic websocket servers should force the app writer to consider which  
origins he wishes to allow connections from.

For instance, in pywebsocket, the default handshake impl echos the origin,  
and the sample app always allows the connection.

http://code.google.com/p/pywebsocket/source/browse/trunk/src/mod_pywebsocket/handshake/handshake.py#196
http://code.google.com/p/pywebsocket/source/browse/trunk/src/example/echo_wsh.py#35

I think it would be better if web_socket_do_extra_handshake required an  
extra parameter (or something) about which origins to allow (maybe with a  
regexp or a list of strings or a string with comma-separated origins with  
a special value like "allow-all-origins").

-- 
Simon Pieters
Opera Software

Re: [hybi] Concerns about Origin Zhong Yu
Re: [hybi] Concerns about Origin Simon Pieters
[hybi] Concerns about Origin Simon Pieters
Re: [hybi] Concerns about Origin John Tamplin
Re: [hybi] Concerns about Origin Zhong Yu
Re: [hybi] Concerns about Origin Zhong Yu
Re: [hybi] Concerns about Origin Simon Pieters
Re: [hybi] Concerns about Origin Simon Pieters
Re: [hybi] Concerns about Origin Sylvain Hellegouarch