Use HTML's origin serialization, add note regarding TAO and redirects #172
Conversation
| <p class="issue" data-number="152">Above "timing allow check" algorithm should also verify that | ||
| no cross-origin redirections were involved in the response, as that would | ||
| leak timing information about those origins. | ||
| </p> |
There was a problem hiding this comment.
Doesn't it do that already? As in, we run TAO check on every response in the processing model and reset the values if the check fails.
There was a problem hiding this comment.
We don't have the concept of a "tainted origin" until we integrate with Fetch. The current processing model talks about "the last non-redirected fetch of the resource", but as @annevk pointed out, there can be a SameOrigin=>X-Origin=>SameOrigin scenario where the spec as is can expose cross-origin information.
There was a problem hiding this comment.
What would it expose in this case?
There was a problem hiding this comment.
The idea is that X-Origin could influence the final SameOrigin in such a way as to attack it. CORS also requires the appropriate headers in such a scenario.
There was a problem hiding this comment.
One scenario could be:
- malicious.com redirects a resource to victim.com (which unfortunately exposes a redirection endpoint, which can redirect back to any arbitrary URL). It uses the redirection endpoint to redirect back to malicious.com.
- With current language, that would expose timing information about victim.com, which may be used to conclude's the user's login state, or other personal information.
There was a problem hiding this comment.
That example doesn't really illustrate why malicious.com would need a TAO header on the final response. This is victim.com requesting something from target.com, which is either compromised or redirects to a a page on victim.com in order to confuse victim.com (or there are even more domains in the chain). And in that case we want victim.com to explicitly opt-in so that we know it agreed to be confused.
There was a problem hiding this comment.
Yes, because the timing allow check itself returns "pass" if the "current resource" is same-origin with the requesting document. That means that EXAMPLE -> ATTACKER -> EXAMPLE would leak because ATTACKER would surely set the header and EXAMPLE does not need to.
|
This PR is obsoleted by #197 |
Addresses some of the concerns for #152
Preview | Diff