Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent cross-origin sensitive header probing #1434

Open
wants to merge 23 commits into
base: main
Choose a base branch
from
Open

Prevent cross-origin sensitive header probing #1434

Changes from 2 commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
13174f5
Prevent cross-origin sensitive header probind
arichiv May 3, 2022
f19bd98
Update fetch.bs
arichiv May 3, 2022
12f8f73
Update fetch.bs
arichiv May 31, 2022
31b775d
Update fetch.bs
arichiv May 31, 2022
4d557f1
Update fetch.bs
arichiv May 31, 2022
c940a8d
Update fetch.bs
arichiv May 31, 2022
077ab19
Update fetch.bs
arichiv May 31, 2022
b0b5293
Update fetch.bs
arichiv Jun 2, 2022
827e6d4
Update fetch.bs
arichiv Jun 3, 2022
40bb9f4
Update fetch.bs
arichiv Jun 3, 2022
901907b
Merge branch 'whatwg:main' into patch-1
arichiv Jun 16, 2022
b9fc11f
Update fetch.bs
arichiv Jun 28, 2022
1702a13
Merge branch 'whatwg:main' into patch-1
arichiv Oct 5, 2022
b4c78ca
Update fetch.bs
arichiv Oct 5, 2022
42669aa
Update fetch.bs
arichiv Oct 5, 2022
236805e
Update fetch.bs
arichiv Oct 5, 2022
3eaeda2
Update fetch.bs
arichiv Oct 5, 2022
4c94c66
Update fetch.bs
arichiv Oct 5, 2022
d7519ef
Update fetch.bs
arichiv Oct 5, 2022
08198aa
Update fetch.bs
arichiv Oct 5, 2022
cb907cd
Update fetch.bs
arichiv Oct 5, 2022
41e7b1d
Update fetch.bs
arichiv Oct 5, 2022
219cd5c
Update fetch.bs
arichiv Oct 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 67 additions & 0 deletions fetch.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2864,6 +2864,73 @@ run these steps:
<li><p>Return <b>allowed</b>.
</ol>

<h3 dfn export lt="prevent sensitive header size probing" id=prevent-sensitive-header-size-probing> Prevent sensitive header
size probing</h3>

Note: The goal of this algorithm is to prevent cross-origin requests from probing the size of sensitive <a for=/>header</a>s
(`<a http-header><code>Authorization</code></a>` or `<a http-header><code>Cookie</code></a>`) by adding <a for=/>header</a>s
to cross-site requests until the total size of all HTTP request <a for=/>header</a>s exceeds the server side limit. In order
for this approach to succeed, servers should not set a HTTP request <a for=/>header</a>s size limit below 8KB.

<p>Run these steps:
arichiv marked this conversation as resolved.
Show resolved Hide resolved

<ol>
<li><p>If the request isn't cross-origin, return.
arichiv marked this conversation as resolved.
Show resolved Hide resolved

<li><p>Let <var>sensitiveHeaderList</var> be the result of filtering <a for=response>header list</a> to include only
arichiv marked this conversation as resolved.
Show resolved Hide resolved
<a for=/>header</a>s with a <a for=/>header name</a> of `<a http-header><code>Authorization</code></a>`,
`<a http-header><code>Cookie</code></a>`, or `<a http-header><code>Sensitive-Header-Truncated</code></a>`.

<li><p>While the serialized size of <var>sensitiveHeaderList</var> is greater than 4KB:

<ol>
<li><p>If the <a for=/>header</a> `<a http-header><code>Authorization</code></a>` is present in
<var>sensitiveHeaderList</var> and `<a http-header><code>Cookie</code></a>` is not present or the
value of `<a http-header><code>Authorization</code></a>` is larger than the value of
`<a http-header><code>Cookie</code></a>`.

<ol>
<li><p><a for="header list">delete</a> `<a http-header><code>Authorization</code></a>` from
<var>sensitiveHeaderList</var>.

<li><p><a for="header list">set</a> `<a http-header><code>Sensitive-Header-Truncated</code></a>` in
<var>sensitiveHeaderList</var> to the value <code>?1</code>.
</ol>

<li><p>Else if the <a for=/>header</a> `<a http-header><code>Cookie</code></a>` is present in
<var>sensitiveHeaderList</var> and `<a http-header><code>Authorization</code></a>` is not present or the
value of `<a http-header><code>Cookie</code></a>` is larger than the value of
`<a http-header><code>Authorization</code></a>`.

<ol>
<li><p><a for="header list">delete</a> `<a http-header><code>Cookie</code></a>` from
<var>sensitiveHeaderList</var>.

<li><p><a for="header list">set</a> `<a http-header><code>Sensitive-Header-Truncated</code></a>` in
<var>sensitiveHeaderList</var> to the value <code>?1</code>.
</ol>
</ol>

<li><p>Let <var>nonSensitiveHeaderList</var> be the result of filtering <a for=response>header list</a> to include
only <a for=/>header</a>s not in <var>sensitiveHeaderList</var>

<li><p>While the serialized size of <var>nonSensitiveHeaderList</var> is greater than 4KB:

<ol>
<li><p>Let <var>nameOfLargestHeader</var> be the name of the largest serialized <a for=/>header</a> in
<var>nonSensitiveHeaderList</var> except `<a http-header><code>Non-Sensitive-Header-Truncated</code></a>`.

<li><p><a for="header list">delete</a> <var>nameOfLargestHeader</var> from <var>nonSensitiveHeaderList</var>.

<li><p><a for="header list">set</a> `<a http-header><code>Non-Sensitive-Header-Truncated</code></a>` in
<var>nonSensitiveHeaderList</var> to the value <code>?1</code>.
</ol>

<li><p>Let <var>newHeaderList</var> be the result of taking <var>sensitiveHeaderList</var> and running
<a for="header list">sort and combine</a> with <var>nonSensitiveHeaderList</var>.

<li><p>Overwrite <a for=response>header list</a> with <var>newHeaderList</var>.
</ol>


<h2 id=http-extensions>HTTP extensions</h2>
Expand Down