Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Issue 73: Text for port-privilege change #97

Merged
merged 2 commits into from Oct 6, 2015
Merged

Issue 73: Text for port-privilege change #97

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0c46f02
Merge remote-tracking branch 'httpwg/master'
MikeBishop Oct 6, 2015
3a2680d
Proposed text for port changes
MikeBishop Oct 6, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
40 changes: 33 additions & 7 deletions draft-ietf-httpbis-alt-svc.xml
View file
Open in desktop
Expand Up @@ -816,17 +816,29 @@ Alt-Used: alternate.example.net
<t>
Using an alternative service implies accessing an origin's resources on an
alternative port, at a minimum. An attacker that can inject alternative services
and listen at the advertised port is therefore able to hijack an origin.
and listen at the advertised port is therefore able to hijack an origin. On
certain servers, it is normal for users to be able to control some personal
pages available on a shared port, and also to accept to requests on less-privileged
ports.
</t>
<t>
For example, an attacker that can add HTTP response header fields can redirect
traffic to a different port on the same host using the Alt-Svc header field; if
that port is under the attacker's control, they can thus masquerade as the HTTP
server.
For example, an attacker that can add HTTP response header fields to some pages
can redirect traffic for an entire origin to a different port on the same host
using the Alt-Svc header field; if that port is under the attacker's control,
they can thus masquerade as the HTTP server.
</t>
<t>
This risk can be mitigated by restricting the ability to advertise alternative
services, and restricting who can open a port for listening on that host.
On servers, this risk can be reducted by restricting the ability to advertise
alternative services, and restricting who can open a port for listening on that host.
Clients can reduce this risk by imposing stronger requirements (e.g. strong
authentication) when moving from System Ports to User or Dynamic Ports, or from
User Ports to Dynamic Ports, as defined in <xref target="RFC6335" x:rel="#section-6"/>.
</t>
<t>
It is always valid for a client to ignore an alternative service advertisement which
does not meet its implementation-specific security requirements. Servers can increase
the likelihood of clients using the alternative service by providing strong
authentication even when not required.
</t>
</section>

Expand Down Expand Up @@ -1082,6 +1094,20 @@ Alt-Used: alternate.example.net
</front>
<seriesInfo name="RFC" value="5246"/>
</reference>

<reference anchor="RFC6335">
<front>
<title>Internet Assigned Numbers Authority (IANA) Procedures for the Management
of the Service Name and Transport Protocol Port Number Registry</title>
<author initials="M." surname="Cotton" fullname="M. Cotton"/>
<author initials="L." surname="Eggert" fullname="L. Eggert"/>
<author initials="J." surname="Touch" fullname="J. Touch"/>
<author initials="M." surname="Westerlund" fullname="M. Westerlund"/>
<author initials="S." surname="Cheshire" fullname="S. Cheshire"/>
<date year="2011" month="August"/>
</front>
<seriesInfo name="RFC" value="6335"/>
</reference>

</references>

Expand Down