8 ms·

Via is not safe to remove and Fastly know this as well as Akamai, Cloudflare and others. A very cheap attack is to chain CDNs into a nice circle. This is what

by buro9 8y ago

Via is not safe to remove and Fastly know this as well as Akamai, Cloudflare and others. A very cheap attack is to chain CDNs into a nice circle. This is what Via protects against: https://blog.cloudflare.com/preventing-malicious-request-loops/ https://blog.cloudflare.com/preventing-malicious-request-loo... Just because a browser doesn't use a header does not make the header superfluous.

djhworld 8y ago
Very interesting link, thanks. I'm not too familiar with this area, but from my understanding of the article, Cloudflare are suggesting that all players in the game need to be compliant otherwise nobody wins So is this Fastly article suggesting a different point of view?
- 21 8y ago
  Well, if one CDN doesn't respect it, it will probably soon find out :) So it's a self correcting problem.
voidlogic 8y ago
Wouldn't it be better to use the "Forwarded" header for this?
- buro9 8y ago
  Why better? Via is a MUST https://tools.ietf.org/html/rfc7230#section-5.7.1 https://tools.ietf.org/html/rfc7230#section-5.7.1 Forwarded is OPTIONAL https://tools.ietf.org/html/rfc7239#section-4 https://tools.ietf.org/html/rfc7239#section-4 Protecting against loops only works with MUST headers.
  - voidlogic 8y ago
    Makes sense. Thanks!
  - ttwwmm 8y ago
    Additionally, Forwarded is only for requests, while Via is for both requests and responses.
khc 8y ago
In addition, having Expires set to a date in the past in not the same as "Cache-Control: no-cache, private". The latter instructs CDNs not to cache the file whereas the former doesn't (CDN is allowed to cache the file and revalidates with the origin). Disclosure: I work at cloudflare.
- crooked-v 8y ago
  You can do that without the Expires header, though. Cache-Control: max-age=0, s-maxage=3600 ...or similar permutations.
  - khc 8y ago
    Yup just want to point out the replacement suggested in the blog is incorrect. Simply max-age=0 should be sufficient to emulate Expires: past date
randomdrake 8y ago
What a terrible stance for a company like Fastly to take: More debatable perhaps is Via, which is required (by RFC7230) to be added to the response by any proxy through which it passes to identify the proxy. This can be something useful like the proxy’s hostname, but is more likely to be a generic identifier like “vegur”, “varnish”, or “squid”. Removing (or not setting) this header is technically a spec violation, but no browsers do anything with it, so it’s reasonably safe to get rid of it if you want to. Actually, it isn’t “debatable,” since the debate occurred, and a decision was made, and published. That’s what RFCs are for. To ignore them with such wanton disregard speaks volumes. Edit: to clarify, I didn't mean that RFCs should not be debated at all, only that disregarding this because "no browsers do anything with it" didn't seem like a good justification or stance.
- tcd 8y ago
  Not really. Standards are nice, but as time goes on, things change, and we should NEVER only change things 'once a standard says so'. The web is an ever evolving platform, and standards are loosely respected these days anyway. Heck, browsers aren't a standard themselves!
  - SahAssar 8y ago
    By that logic there isn't any point to standards at all. If we all are supposed to ignore them when we feel like it then what's the point of having them at all? If there is a standard published for something, follow it or publish your own RFC. Don't just nitpick the bits you want and break clients in the process.
    - tptacek 8y ago
      They're provided as guidance. They aren't some kind of internet law. Sometimes contravening standards is harmful; sometimes it's helpful. It's not productive to point at them as if they were dispositive in debates.
      - quickben 8y ago
yongjik 8y ago
Your use of the term "attack" seems to imply that a malicious client can trigger circular request loops by using a cleverly forged request. But I cannot understand how it could happen, unless the proxy servers are misconfigured. Am I missing something?
- jessaustin 8y ago
  The link above describes numerous proxies as not so much misconfigured as miscoded. That is, no configuration should cause a proxy to not apply a Via or to ignore its own Via. Presumably the attacker would be a malicious proxy customer rather than a malicious client. If the proxy customer is not considered as a monolith, then actually control of just one proxy's configuration is enough to turn a chain into a loop.
  - yongjik 8y ago
    I still feel like I'm missing something, because it sounds like "If an attacker can rewrite your configuration inside CDN, bad things will happen." I mean, Via might be useful as a safety check against mistake, but I'm not getting the security angle.
    - jessaustin 8y ago
      The threat is a DOS against a group of CDNs as a whole. Particular CDN customers are only vulnerable to the extent that they require an affected CDN's services. If the CF link isn't clear, click through to the paper they reference: http://www.icir.org/vern/papers/cdn-loops.NDSS16.pdf http://www.icir.org/vern/papers/cdn-loops.NDSS16.pdf
      - dingaling 8y ago
        But that's all delicately balanced on trusting the Via headers. If you are under attack from someone malicious then that seems unwise. It's like relying on the From: header in an e-mail.
pvg 8y ago
They're talking about responses in which Via is technically 'required' but pretty useless. The blog post you linked seems to be about the use of the header in requests.
lxe 8y ago
How is Via different from “X-Forwarded-For”?
- manigandham 8y ago
  They are in different directions: Via => proxy/organization name chain where the response came from X-Forwarded-For => ip address chain where the request came from
buro9 8y ago
lol... and then I come into work and find out from my colleague that actually Cloudflare now disables the Via header by default.
- deleted 8y ago
  [deleted]
- elithrar 8y ago
  For those wanting the extra context around this decision: There's a really important reason for not sending the Via header in the request: it disables compression, by default, in most major web-servers! · nginx defaults gzip_proxied to "off", where 'proxied' is determined by the presence of the Via header: http://nginx.org/en/docs/http/ngx_http_gzip_module.html#gzip_proxied http://nginx.org/en/docs/http/ngx_http_gzip_module.html#gzip... · The same goes for IIS 7 & IIS 8 via noCompressionForProxies defaulting to "true" - https://docs.microsoft.com/en-us/iis/configuration/system.webserver/httpcompression/ https://docs.microsoft.com/en-us/iis/configuration/system.we... · Apache's mod_deflate doesn't do this (thankfully). This has an immediately negative impact on performance and, in many cases, cost: the origin server is sending more bytes over the wire, and network transit is often a non-trivial cost for those on AWS, Azure, et. al. Akamai also has a post on this: https://community.akamai.com/community/web-performance/blog/2015/05/06/beware-the-via-header-disabled-compression-can-have-a-performance-impact https://community.akamai.com/community/web-performance/blog/... Note: I used to work at Cloudflare, and believe they (we!) made the right decision here. There are other mechanisms that can be used to detect proxy loops, and there are also cases where customers may "stack" edge network vendors (migration, specific feature needs, application complexity). PS: Hi David! :)
kelnos 8y ago
The article mentions that Via is useful while the request is bouncing around among proxies, but isn't useful in responses, which is what the article is about.

by buro9 8y ago

djhworld 8y ago

Very interesting link, thanks. I'm not too familiar with this area, but from my understanding of the article, Cloudflare are suggesting that all players in the game need to be compliant otherwise nobody wins So is this Fastly article suggesting a different point of view?

21 8y ago
Well, if one CDN doesn't respect it, it will probably soon find out :) So it's a self correcting problem.

voidlogic 8y ago

Wouldn't it be better to use the "Forwarded" header for this?

buro9 8y ago
Why better? Via is a MUST https://tools.ietf.org/html/rfc7230#section-5.7.1 https://tools.ietf.org/html/rfc7230#section-5.7.1 Forwarded is OPTIONAL https://tools.ietf.org/html/rfc7239#section-4 https://tools.ietf.org/html/rfc7239#section-4 Protecting against loops only works with MUST headers.
- voidlogic 8y ago
  Makes sense. Thanks!
- ttwwmm 8y ago
  Additionally, Forwarded is only for requests, while Via is for both requests and responses.

khc 8y ago

In addition, having Expires set to a date in the past in not the same as "Cache-Control: no-cache, private". The latter instructs CDNs not to cache the file whereas the former doesn't (CDN is allowed to cache the file and revalidates with the origin). Disclosure: I work at cloudflare.

crooked-v 8y ago
You can do that without the Expires header, though. Cache-Control: max-age=0, s-maxage=3600 ...or similar permutations.
- khc 8y ago
  Yup just want to point out the replacement suggested in the blog is incorrect. Simply max-age=0 should be sufficient to emulate Expires: past date

randomdrake 8y ago

What a terrible stance for a company like Fastly to take: More debatable perhaps is Via, which is required (by RFC7230) to be added to the response by any proxy through which it passes to identify the proxy. This can be something useful like the proxy’s hostname, but is more likely to be a generic identifier like “vegur”, “varnish”, or “squid”. Removing (or not setting) this header is technically a spec violation, but no browsers do anything with it, so it’s reasonably safe to get rid of it if you want to. Actually, it isn’t “debatable,” since the debate occurred, and a decision was made, and published. That’s what RFCs are for. To ignore them with such wanton disregard speaks volumes. Edit: to clarify, I didn't mean that RFCs should not be debated at all, only that disregarding this because "no browsers do anything with it" didn't seem like a good justification or stance.

tcd 8y ago
Not really. Standards are nice, but as time goes on, things change, and we should NEVER only change things 'once a standard says so'. The web is an ever evolving platform, and standards are loosely respected these days anyway. Heck, browsers aren't a standard themselves!
- SahAssar 8y ago
  By that logic there isn't any point to standards at all. If we all are supposed to ignore them when we feel like it then what's the point of having them at all? If there is a standard published for something, follow it or publish your own RFC. Don't just nitpick the bits you want and break clients in the process.
  - tptacek 8y ago
    They're provided as guidance. They aren't some kind of internet law. Sometimes contravening standards is harmful; sometimes it's helpful. It's not productive to point at them as if they were dispositive in debates.
    - quickben 8y ago

yongjik 8y ago

Your use of the term "attack" seems to imply that a malicious client can trigger circular request loops by using a cleverly forged request. But I cannot understand how it could happen, unless the proxy servers are misconfigured. Am I missing something?

jessaustin 8y ago
The link above describes numerous proxies as not so much misconfigured as miscoded. That is, no configuration should cause a proxy to not apply a Via or to ignore its own Via. Presumably the attacker would be a malicious proxy customer rather than a malicious client. If the proxy customer is not considered as a monolith, then actually control of just one proxy's configuration is enough to turn a chain into a loop.
- yongjik 8y ago
  I still feel like I'm missing something, because it sounds like "If an attacker can rewrite your configuration inside CDN, bad things will happen." I mean, Via might be useful as a safety check against mistake, but I'm not getting the security angle.
  - jessaustin 8y ago
    The threat is a DOS against a group of CDNs as a whole. Particular CDN customers are only vulnerable to the extent that they require an affected CDN's services. If the CF link isn't clear, click through to the paper they reference: http://www.icir.org/vern/papers/cdn-loops.NDSS16.pdf http://www.icir.org/vern/papers/cdn-loops.NDSS16.pdf
    - dingaling 8y ago
      But that's all delicately balanced on trusting the Via headers. If you are under attack from someone malicious then that seems unwise. It's like relying on the From: header in an e-mail.

pvg 8y ago

They're talking about responses in which Via is technically 'required' but pretty useless. The blog post you linked seems to be about the use of the header in requests.

lxe 8y ago

How is Via different from “X-Forwarded-For”?

manigandham 8y ago
They are in different directions: Via => proxy/organization name chain where the response came from X-Forwarded-For => ip address chain where the request came from

buro9 8y ago

lol... and then I come into work and find out from my colleague that actually Cloudflare now disables the Via header by default.

deleted 8y ago
[deleted]
elithrar 8y ago
For those wanting the extra context around this decision: There's a really important reason for not sending the Via header in the request: it disables compression, by default, in most major web-servers! · nginx defaults gzip_proxied to "off", where 'proxied' is determined by the presence of the Via header: http://nginx.org/en/docs/http/ngx_http_gzip_module.html#gzip_proxied http://nginx.org/en/docs/http/ngx_http_gzip_module.html#gzip... · The same goes for IIS 7 & IIS 8 via noCompressionForProxies defaulting to "true" - https://docs.microsoft.com/en-us/iis/configuration/system.webserver/httpcompression/ https://docs.microsoft.com/en-us/iis/configuration/system.we... · Apache's mod_deflate doesn't do this (thankfully). This has an immediately negative impact on performance and, in many cases, cost: the origin server is sending more bytes over the wire, and network transit is often a non-trivial cost for those on AWS, Azure, et. al. Akamai also has a post on this: https://community.akamai.com/community/web-performance/blog/2015/05/06/beware-the-via-header-disabled-compression-can-have-a-performance-impact https://community.akamai.com/community/web-performance/blog/... Note: I used to work at Cloudflare, and believe they (we!) made the right decision here. There are other mechanisms that can be used to detect proxy loops, and there are also cases where customers may "stack" edge network vendors (migration, specific feature needs, application complexity). PS: Hi David! :)

kelnos 8y ago

The article mentions that Via is useful while the request is bouncing around among proxies, but isn't useful in responses, which is what the article is about.