Re: Chromium's support for CORS and UMP

On Mon, May 10, 2010 at 6:38 PM, Bjoern Hoehrmann <derhoermi@gmx.net> wrote:
> * Nathan wrote:
>>> If you do not depend on a user's special standing with a third party
>>> site, you can configure your server as proxy between your user and the
>>> third party site. That's more difficult for you, but easier for users
>>> and maintainers of third party sites. If we'd do away with the access
>>> restriction, it'd be easier for you, and more difficult for users and
>>> third parties. What we have now is largely due to following the path
>>> of least resistance (which is probably true for most web technology).
>
>>Is it possible to set up a server as a proxy, where a client side ssl
>>certificate is also proxied through, should the server at the address
>>being proxied request one?
>
> If there is a special relationship between the user and the third party
> site, your site would similarily have to have a special relationship
> with at least one of them (for example, you might need the user's certi-
> ficate). In essence, in this scenario, the third party restricts access
> to those who can prove a certain identity; since you are not them, you
> cannot do that. This would be a rather broken scenario though, on the
> one hand you cannot directly access the third party server because you
> lack some user's certificate; on the other hand, you do have access to
> it if your server proxies the access over the user's browser (if there
> were no access restrictions in place, be those default rules or "CORS"
> rules or something along those lines). That is largely the problem that
> is sought to be avoided here.

For what it's worth, my main concern isn't IP based authentication
between different 3rd parties.

My main concern is corporate firewalls which allow users sitting
inside the firewall to access content on intranet servers, while
preventing outside parties from even sending IP packets that reach
those intranet servers.

A browser running on a computer inside the firewall must not allow
external sites to access the internal servers, effectively using the
browser as a proxy to circumvent the firewall. If a browser allowed
that I suspect it would become very unpopular. Rightly so in my
opinion.

/ Jonas

Received on Tuesday, 11 May 2010 01:50:44 UTC