- From: Martin Thomson <martin.thomson@gmail.com>
- Date: Fri, 10 May 2013 15:21:15 -0700
- To: James M Snell <jasnell@gmail.com>
- Cc: "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
On 10 May 2013 14:36, James M Snell <jasnell@gmail.com> wrote: > FWIW, one possible attack vector this would help mitigate is "frame smuggling".. > > For example, suppose an attacker is sending a request through a proxy > that is designed to filter out certain kinds of bad requests. The > attacker determines that while the proxy properly examines both the > size and type of a frame, it ignores extraneous bytes in known frame > types and simply passes those thru. There is your problem right there. A proxy that wants to prevent this sort of covert activity needs to look for unknown frame types, unknown headers, unknown message bodies AND unknown frame parameters. It should also look for all of the other covert channels in HTTP, of which there are a wondrously large number available. It would be a sorry smuggler who had to resort to message timing for their covert channel in this protocol.
Received on Friday, 10 May 2013 22:21:42 UTC