Subject: [Doh] notes on CORS and DoH

From: Tony Finch <[email-masked]>
Date: Wed, 7 Nov 2018 11:48:57 +0000

I've amended my `doh101` implementation to support cross-origin requests
from browsers.

https://github.com/fanf2/doh101/

DoH GET requests count as "simple requests" from the point of view of
CORS, so they do not require any special support on the server to be
available to any web page. However, because query strings are usually
logged by web servers, DoH GET requests have somewhat worse privacy
properties than POST requests. So it seemed to be worth implementing CORS,
so that POST is available wherever GET is.

What I've done is add `Access-Control-Allow-Origin: *` to regular DoH
responses, and I added support for OPTIONS requests which reply with:

   Access-Control-Allow-Origin: *
   Access-Control-Allow-Methods: OPTIONS, HEAD, GET, POST
   Access-Control-Allow-Headers: Content-Type
   Access-Control-Max-Age: 86400

It's roughly in line with what Cloudflare does for
https://cloudflare-dns.com/dns-query
(Except I'm using a longer method list which matches what I return
for 405 method not allowed errors.)

I've had a very brief look at some of the DoH servers listed at
https://github.com/curl/curl/wiki/DNS-over-HTTPS#doh-tools
and CORS support seems to be relatively rare.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Fisher, German Bight: Southeast 5 to 7, veering south or southwest 4 or 5.
Moderate or rough. Showers. Good occasionally poor.

---

From: Star Brilliant <[email-masked]>
Date: Wed, 7 Nov 2018 12:23:28 +0000

> and CORS support seems to be relatively rare.

Hello Tony,

Thank you for your reminder!

I also amended my implementation [1]. The code is pending to be released before I test it through-out.

I consider there are no security issues with CORS.
But, does the browser-side cache work for a single URL or a whole site? Will it be a problem if a DoH server shares the same hostname with another website?

Best regards,
StarBrilliant

[1]: https://github.com/m13253/dns-over-https/commit/4754aa0414840349dc22a11b954d5f2c8243cf00

---

From: Tony Finch <[email-masked]>
Date: Wed, 7 Nov 2018 13:40:05 +0000

Star Brilliant <[email-masked]> wrote:

> But, does the browser-side cache work for a single URL or a whole site?
> Will it be a problem if a DoH server shares the same hostname with
> another website?

Good question: it isn't super clear from the MDN docs. But on
further investigation I see the Fetch spec says it's per URL:
https://fetch.spec.whatwg.org/#concept-cache

[ I was wondering what to set the max-age to, and randomly chose
1 day which happens to be the same as the cap applied by Firefox.
Cloudflare set their max-age to 1 week. ]

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Shannon: South or southwest 5 to 7, increasing gale 8 at times. Very rough,
becoming high. Rain or thundery showers. Poor.

---

From: Patrick McManus <[email-masked]>
Date: Thu, 8 Nov 2018 08:20:23 +0700

> But, does the browser-side cache work for a single URL or a whole site?

cors granularity is a little finer than per url (you salt the url with
credentials, method, etc..)

> Will it be a problem if a DoH server shares the same hostname with another
> website?
>

not for cors, and generally not at all. There's nothing wrong with multiple
doh servers (with multiple resoltuion policies) sharing the same origin.

There are a couple things that apply site-wide in http, but very few. (hsts
for example.)

>
> Best regards,
> StarBrilliant
>
> [1]:
> https://github.com/m13253/dns-over-https/commit/4754aa0414840349dc22a11b954d5f2c8243cf00
> _______________________________________________
> Doh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/doh
>
>