Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Request forgery/cross-protocol attacks #175

Closed
martinthomson opened this issue Dec 9, 2020 · 2 comments · Fixed by #369
Closed

Request forgery/cross-protocol attacks #175

martinthomson opened this issue Dec 9, 2020 · 2 comments · Fixed by #369
Assignees
@martinthomson
Labels
Ready for PR
Milestone
Minimum viable ship

Comments

@martinthomson
Copy link
Member

The current security considerations text implies that there are good defenses against cross-protocol attacks. QUIC isn't completely free from this style of attack. Some careful rewording might be needed.
@jan-ivar
Copy link
Member

@martinthomson Would you like to provide some prose suggestions?

@martinthomson
Copy link
Member Author

A citation for Section 21.5 of QUIC might be a good way to avoid having to say anything too carefully.

(I can't promise to get to this soon, but keep me assigned.)

@wilaw wilaw added this to the Minimum viable ship milestone Jun 2, 2021
martinthomson added a commit to martinthomson/webtransport that referenced this issue Oct 13, 2021
@martinthomson
Remove text on request forgery
02a8fbf 
In looking into this text and the related specifications I decided that
it would be better to address the risk of request forgery in the
protocol specifications.  Right now, they say nothing about this
problem, but they really should.  I'm going to open an issue.

On the assumption that the protocol documents address this problem
adequately, then this document doesn't need to concern itself with the
problem.  It is enough to remove any false claims and defer to the
protocol spec.

This contains a tweak to the adjacent text for the Origin field (w3c#368),
but it doesn't fix that issue.

Closes w3c#175.
This was referenced Oct 13, 2021
Merged
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@martinthomson martinthomson

Labels
Ready for PR
Projects
None yet
Milestone
Minimum viable ship
Development

Successfully merging a pull request may close this issue.

Remove text on request forgery martinthomson/webtransport
3 participants
@martinthomson @wilaw @jan-ivar