Strengthen requirements on CORS-safelisted request-headers #736

annevk · 2018-05-25T09:19:45Z

This should reduce the attack surface of non-preflighted requests quite a bit.

Fixes #382. Closes #313.

annevk · 2018-05-25T09:21:59Z

@johnwilander @mikewest @ckerschb @bzbarsky I'd appreciate your review. @sicking this goes against what you advocated for in #313, but given Safari's success in locking this down and given that there continue to be security bugs in this area due to it not being locked down I think this is the responsible path forward.

annevk · 2018-05-25T09:23:05Z

fetch.bs

+  </dl>
+
+ <li><p>If <var>value</var>'s <a for="byte sequence">length</a> is greater than 128, then return
+ false.


This is one step that Safari does not have, but it would help to have it to make it harder for attackers to determine cookie size and such.

Don't we need to think about the total length of all headers, rather than the length of each header?

Yeah, if we keep adding headers to this safelist that would indeed become a concern. Otherwise I was thinking that a low enough individual limit would make that unneeded.

annevk · 2018-05-28T14:23:54Z

@yutakahirano I looked at all callers of CORS-safelisted request-header and considered an alternative design whereby the input is a header list and the output is a list of headers that are not safelisted. That way we could have an overall size limit and if it is reached we'd just not safelist anything.

However, the one problem with this approach is the Headers object and its "request-no-cors" guard. That fundamentally requires per-header decisions. I don't think we can delay that check and there's no CORS-preflight fetch fallback either.

Perhaps the solution to that is that we freeze "request-no-cors" to Accept, Accept-Language, Content-Language, and Content-Type, with the 128 header value byte limit. That seems good as I don't think we want to continue to expand the API surface of no-cors. And then for the CORS protocol we impose an overall 1024 byte limit (and perhaps have the per-header limit as well?).

annevk · 2018-05-30T12:37:43Z

I've pushed some commits that illustrate my above comment. I also filed #748 as a follow-up.

Would love feedback from @yutakahirano @wanderview @chenjj and folks I tagged earlier.

wanderview

Seems ok to me, but I defer to @ckerschb @bzbarsky here.

wanderview · 2018-05-31T20:36:02Z

fetch.bs

@@ -414,38 +414,92 @@ each other by 0x2C 0x20, in order.

 <hr>

-<p id=simple-header>A <dfn export>CORS-safelisted request-header</dfn> is a <a for=/>header</a>
-whose <a for=header>name</a> is a <a>byte-case-insensitive</a> match for one of
+<p id=simple-header>To determine whether a <a for=/>header</a> <var>header</var> is a


Did you intent to produce text that says "header header" with the first header linked?

Oh, I guess this is just <type> <var name>. Its just confusing to me when the type and variable name are identical.

For whatwg/fetch#736.

annevk · 2018-06-08T14:24:57Z

I wrote tests for this at web-platform-tests/wpt#11432. I'm assuming at this point that Chrome and Firefox are on board with implementing this, but I'll give it some more time before landing all the things.

This should reduce the attack surface of non-preflighted requests quite a bit. Tests: web-platform-tests/wpt#11432. Fixes #382. Closes #313.

…ined value size

annevk · 2018-06-18T12:56:30Z

I think this is good now. I'm planning on keeping this as 3 distinct commits since they're somewhat separate features, but all the tests are grouped.

domfarolino · 2018-06-19T06:44:18Z

This looks good to me

For whatwg/fetch#736.

annevk · 2018-08-16T10:44:54Z

Bugs:

…ns, a=testonly Automatic update from web-platform-testsFetch: tests for further CORS restrictions For whatwg/fetch#736. -- wpt-commits: a70e655d979df85b59e977b61361c0d6d8bf2bf2 wpt-pr: 11432

For whatwg/fetch#736.

See whatwg/fetch#736 for context.

With this CL, some request headers that used to be treated as CORS-safelisted are not CORS-safelisted any more. Specifically, - "accept", "accept-language" and "content-language" have a stronger check on its value - All headers whose value exceeds 128 bytes are treated as not CORS-safelisted - If the sum of value length of CORS-safelisted headers exceeds 1024, then all of them are treated as not CORS-safelisted. This CL also implements https://fetch.spec.whatwg.org/#no-cors-safelisted-request-header. This is for whatwg/fetch#736. Bug: 824130 Cq-Include-Trybots: luci.chromium.try:linux_mojo Change-Id: Ib12a7dbff6367717a43130ae59304dca55b7bf4e Reviewed-on: https://chromium-review.googlesource.com/1196563 Commit-Queue: Yutaka Hirano <yhirano@chromium.org> Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org> Cr-Commit-Position: refs/heads/master@{#589153}

This reverts commit 074455d. Reason for revert: Suspected of causing check failures across a variety of tests on the Android CFI bot. See https://crbug.com/881538 for more details. Original change's description: > Strengthen requirements on CORS-safelisted request-headers > > With this CL, some request headers that used to be treated as > CORS-safelisted are not CORS-safelisted any more. Specifically, > > - "accept", "accept-language" and "content-language" have a stronger > check on its value > - All headers whose value exceeds 128 bytes are treated as not > CORS-safelisted > - If the sum of value length of CORS-safelisted headers exceeds 1024, > then all of them are treated as not CORS-safelisted. > > This CL also implements > https://fetch.spec.whatwg.org/#no-cors-safelisted-request-header. > > This is for whatwg/fetch#736. > > Bug: 824130 > Cq-Include-Trybots: luci.chromium.try:linux_mojo > Change-Id: Ib12a7dbff6367717a43130ae59304dca55b7bf4e > Reviewed-on: https://chromium-review.googlesource.com/1196563 > Commit-Queue: Yutaka Hirano <yhirano@chromium.org> > Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org> > Cr-Commit-Position: refs/heads/master@{#589153} TBR=toyoshim@chromium.org,yhirano@chromium.org Change-Id: I9952df291ff0aeaab0b50c6cff3de418b2272e71 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: 824130, 881538 Cq-Include-Trybots: luci.chromium.try:linux_mojo Reviewed-on: https://chromium-review.googlesource.com/1211958 Reviewed-by: Justin Donnelly <jdonnelly@chromium.org> Commit-Queue: Justin Donnelly <jdonnelly@chromium.org> Cr-Commit-Position: refs/heads/master@{#589323}

This is a reland of 074455d Original change's description: > Strengthen requirements on CORS-safelisted request-headers > > With this CL, some request headers that used to be treated as > CORS-safelisted are not CORS-safelisted any more. Specifically, > > - "accept", "accept-language" and "content-language" have a stronger > check on its value > - All headers whose value exceeds 128 bytes are treated as not > CORS-safelisted > - If the sum of value length of CORS-safelisted headers exceeds 1024, > then all of them are treated as not CORS-safelisted. > > This CL also implements > https://fetch.spec.whatwg.org/#no-cors-safelisted-request-header. > > This is for whatwg/fetch#736. > > Bug: 824130 > Cq-Include-Trybots: luci.chromium.try:linux_mojo > Change-Id: Ib12a7dbff6367717a43130ae59304dca55b7bf4e > Reviewed-on: https://chromium-review.googlesource.com/1196563 > Commit-Queue: Yutaka Hirano <yhirano@chromium.org> > Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org> > Cr-Commit-Position: refs/heads/master@{#589153} Bug: 824130 Change-Id: Ia5caad12a51ee44713cf4cf11f42b1fc9ab831a9 Cq-Include-Trybots: luci.chromium.try:linux_mojo Tbr: toyoshim@chromium.org Reviewed-on: https://chromium-review.googlesource.com/1212425 Commit-Queue: Yutaka Hirano <yhirano@chromium.org> Reviewed-by: Yutaka Hirano <yhirano@chromium.org> Cr-Commit-Position: refs/heads/master@{#589434}

…a "safelisted headers" rules, a=testonly Automatic update from web-platform-testsFetch: align CORS test with new "safelisted headers" rules See whatwg/fetch#736 for context. -- wpt-commits: efa5cebbd4a2b5df055a12212c534b13052154b8 wpt-pr: 12797

…a "safelisted headers" rules, a=testonly Automatic update from web-platform-testsFetch: align CORS test with new "safelisted headers" rules See whatwg/fetch#736 for context. -- wpt-commits: efa5cebbd4a2b5df055a12212c534b13052154b8 wpt-pr: 12797 UltraBlame original commit: 73dd9c2269361e4965ea1ab1f8eadc2addc9b934

annevk added the needs tests Moving the issue forward requires someone to write tests label May 25, 2018

annevk commented May 25, 2018

View reviewed changes

annevk force-pushed the annevk/cors-safelisted-request-header branch 3 times, most recently from 8c2a14f to bcca834 Compare May 30, 2018 12:01

annevk mentioned this pull request May 30, 2018

CORS request-header Content-Type check should be on a combined value #748

Closed

annevk force-pushed the annevk/cors-safelisted-request-header branch from 121c13d to 6a8e844 Compare May 30, 2018 12:39

annevk added the topic: cors label May 30, 2018

yutakahirano approved these changes May 31, 2018

View reviewed changes

wanderview reviewed May 31, 2018

View reviewed changes

annevk mentioned this pull request Jun 1, 2018

Add Last-Event-ID as CORS-safelisted request-header #597

Closed

annevk added a commit to web-platform-tests/wpt that referenced this pull request Jun 8, 2018

Fetch: tests for further CORS restrictions

487fe8c

For whatwg/fetch#736.

annevk mentioned this pull request Jun 8, 2018

Fetch: tests for further CORS restrictions web-platform-tests/wpt#11432

Merged

annevk added 3 commits June 18, 2018 14:54

Strengthen requirements on CORS-safelisted request-headers

e311d26

This should reduce the attack surface of non-preflighted requests quite a bit. Tests: web-platform-tests/wpt#11432. Fixes #382. Closes #313.

Strengthen requirements on Headers with guard "request-no-cors"

1255516

Strengthen requirements on CORS even further by having a maximum comb…

603ca21

…ined value size

annevk force-pushed the annevk/cors-safelisted-request-header branch from 6800438 to 603ca21 Compare June 18, 2018 12:54

annevk removed the needs tests Moving the issue forward requires someone to write tests label Aug 16, 2018

annevk merged commit e2d62ff into master Aug 16, 2018

annevk deleted the annevk/cors-safelisted-request-header branch August 16, 2018 10:20

annevk added a commit to web-platform-tests/wpt that referenced this pull request Aug 16, 2018

Fetch: tests for further CORS restrictions

a70e655

For whatwg/fetch#736.

jdm mentioned this pull request Aug 16, 2018

Implement new requirements for CORS-safelisted request headers servo/servo#21435

Open

annevk mentioned this pull request Aug 24, 2018

CH processing, cross-origin redirects and service workers #800

Closed

zcorpan pushed a commit to web-platform-tests/wpt that referenced this pull request Aug 27, 2018

Fetch: tests for further CORS restrictions

28be691

For whatwg/fetch#736.

yutakahirano mentioned this pull request Sep 3, 2018

Update cors/simple-requests.htm for extra "safelisted headers" rules web-platform-tests/wpt#12797

Merged

annevk pushed a commit to web-platform-tests/wpt that referenced this pull request Sep 5, 2018

Fetch: align CORS test with new "safelisted headers" rules

efa5ceb

See whatwg/fetch#736 for context.

annevk mentioned this pull request Jun 7, 2018

Support for custom headers for handshake whatwg/websockets#16

Open

miketaylr mentioned this pull request Nov 20, 2020

Impact on same-origin policy WICG/client-hints-infrastructure#100

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Strengthen requirements on CORS-safelisted request-headers #736

Strengthen requirements on CORS-safelisted request-headers #736

annevk commented May 25, 2018 •

edited by pr-preview bot

Loading

annevk commented May 25, 2018

annevk May 25, 2018

yutakahirano May 25, 2018

annevk May 25, 2018

annevk commented May 28, 2018

annevk commented May 30, 2018

wanderview left a comment

wanderview May 31, 2018

wanderview May 31, 2018

annevk commented Jun 8, 2018

annevk commented Jun 18, 2018

domfarolino commented Jun 19, 2018

annevk commented Aug 16, 2018

Strengthen requirements on CORS-safelisted request-headers #736

Strengthen requirements on CORS-safelisted request-headers #736

Conversation

annevk commented May 25, 2018 • edited by pr-preview bot Loading

annevk commented May 25, 2018

annevk May 25, 2018

Choose a reason for hiding this comment

yutakahirano May 25, 2018

Choose a reason for hiding this comment

annevk May 25, 2018

Choose a reason for hiding this comment

annevk commented May 28, 2018

annevk commented May 30, 2018

wanderview left a comment

Choose a reason for hiding this comment

wanderview May 31, 2018

Choose a reason for hiding this comment

wanderview May 31, 2018

Choose a reason for hiding this comment

annevk commented Jun 8, 2018

annevk commented Jun 18, 2018

domfarolino commented Jun 19, 2018

annevk commented Aug 16, 2018

annevk commented May 25, 2018 •

edited by pr-preview bot

Loading