9 ms·
Fixing domain fronting is easy. You just match the certificate SANs (or SNI requested domain) to the request Host header. The only problem is it breaks a subse
by dsl 8y ago
Fixing domain fronting is easy. You just match the certificate SANs (or SNI requested domain) to the request Host header.
The only problem is it breaks a subset of users who are domain fronting by accident (Think a mobile app that connects to www.app.com but sends api.app.com).
- Boulth 8y agoThis also breaks non terminating load balancers.
- foobarbazetc 8y agoI’ve used every major CDN on the market and none of them do this. Some don’t even check that the Host header host is a customer and just proxy it anyway.
- dsl 8y agoI said the fix was easy, not that people were actually fixing it. :/