Examples are inconsistent about http vs https

[davidben]

Example 1 says the router management site is deployed at http://admin:admin@router.local/set_dns. However, the example later uses an iframe to https://admin:admin@router.local/set_dns in the attack.

Example 3 says the internal link-shortening service is at https://go/. The next paragraph then talks about clicking http://go/* links. It then goes back to talking about leaking https://go/shortlink.

Given intranet sites tend not to use https, I'm guessing all of these were meant to be http?

[jyasskin]

Switching Example 1 to consistently use http:// makes it rely on mixed content blocking instead of the new CORS preflight. Switching csrf.attack to also use http makes the example rely on the secure context restriction instead of the new CORS preflight. To exercise the CORS preflight, the internal IP server needs to actually use HTTPS, but then the router example isn't realistic since home routers can't run a publicly-trusted HTTPS server with a usable DNS name.

Example 3 can probably accommodate http://go/ since mixed content doesn't block https->http navigations. That'll prevent the redirector from redirecting to any local services because of the secure context restriction. If #39 happens, it also won't be able to redirect to any private addresses.

[davidben]

Oh huh, good point. Now that even passive mixed content is blocked, does this mean the address space preflight is mostly navigation-only? (That and more complex intranet examples where private services can actually deploy HTTPS.)

I guess, in the description of example 1, top-level navigation works just as well as an attack vector (the example says "by navigating to http://admin:admin@router.local/set_dns and passing in various GET parameters"). So the preflight is still load-bearing here, but it is a little unsatisfying to use navigation in both examples.

[letitz]

It's true that https://router.local is not currently possible. We can instead describe something like Plex's scenario: https://abcdefgh.nas.example?

I agree that it would be best to showcase an example for both kinds of requests: subresources and navigations.