Subject: [hybi] Origin header server validation

From: Sylvain Hellegouarch <[email-masked]>
Date: Fri, 16 Sep 2011 21:34:37 +0200

Hi all,

Draft-14 says:

The request MUST include a header field with the name "Origin"
> [I-D.ietf-websec-origin <http://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-14#ref-I-D.ietf-websec-origin>] if the request is coming from a browser
> client.  If the connection is from a non-browser client, the
> request MAY include this header field if the semantics of that
> client match the use-case described here for browser clients.
>
>

Now, how does a server determines if the request comes from a browser? What
I mean is, browser vendors will of course send this header but if it's not
present, servers cannot make a decision whether or not this is a browser
request that has been mended and should be failed or a legit fat client
request. As the spec stands, I'm missing what my server is supposed to do
from that definition.

-- 
- Sylvain
http://www.defuze.org
http://twitter.com/lawouach

---

From: John Tamplin <[email-masked]>
Date: Fri, 16 Sep 2011 15:38:30 -0400

> request. As the spec stands, I'm missing what my server is supposed to do

I would assume that it is a server policy decision whether it requires the
header or accepts any request not including the header.

-- 
John A. Tamplin
Software Engineer (GWT), Google

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Fri, 16 Sep 2011 21:39:02 +0200

It is the same as if you receive an HTTP request. You have no way to
determine whether it comes from a browser or a script.
El 16/09/2011 21:34, "Sylvain Hellegouarch" <[email-masked]> escribió:
>> [I-D.ietf-websec-origin <
http://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-14#ref-I-D.ietf-websec-origin>]
if the request is coming from a browser

---

From: Sylvain Hellegouarch <[email-masked]>
Date: Fri, 16 Sep 2011 21:47:13 +0200

> determine whether it comes from a browser or a script.

Well I see it a bit differently since the Origin header carries an important
initial security requirement for WebSocket, if the header is like any other
one, then why would the spec even bother with making a distinction between
browsers and other clients?

---

From: Sylvain Hellegouarch <[email-masked]>
Date: Fri, 16 Sep 2011 21:47:45 +0200

On Fri, Sep 16, 2011 at 9:38 PM, John Tamplin <[email-masked]> wrote:

> On Fri, Sep 16, 2011 at 3:34 PM, Sylvain Hellegouarch <[email-masked]>wrote:
>
>> Draft-14 says:
>>
>> Now, how does a server determines if the request comes from a browser?
>> What I mean is, browser vendors will of course send this header but if it's
>> not present, servers cannot make a decision whether or not this is a browser

That sounds fair.

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Fri, 16 Sep 2011 22:01:39 +0200

>browsers and other clients?

If this isn't explained in the current draft, it should be. A browser is
expected to occasionally land on malicious content. The device it runs
on may be connected to both the Internet and some internal network. This
would allow Internet content to make the browser initiate connections to
some internal resource. The browser does not have a reliable way to de-
cide whether the internal resource is okay with some possibly malicious
site forcing a connection attempt. So the browser tells the server where
the request has been initiated from, so the server can deal with this as
it sees fit. (Internal here means the client has some special relation-
ship with the site that not "practically everyone on the Internet" has.)

Wither other types of clients you typically do not have such "drive-by"
scenarios, so there is little reason to require all clients to send the
header (they may not in fact have a well-defined "Origin" so they'd just
send "unknown" or redundant or otherwise problematic information). That
this is bound to browser/non-browser instead of the specific criteria is
a bit unfortunate, but not that much of an issue so long as the reasons
are properly explained in the specification.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Fri, 16 Sep 2011 22:01:46 +0200

> browsers and other clients?

I don't think Origin header means more in WebSocket than in HTTP. It
is just valid for ensuring that "normal" web-browsers access to a
server resource from a specific web site, no more.

-- 
Iñaki Baz Castillo
<[email-masked]>