3 ms·
mTLS has warts when used cross-origin. Fetch spec says that pre-flight requests mustn't include client certificates[1], so as a consequence servers behind mTLS
by kreetx 3y ago
mTLS has warts when used cross-origin. Fetch spec says that pre-flight requests mustn't include client certificates[1], so as a consequence servers behind mTLS authenticated proxy won't get a chance to reply to those pre-flight. Yet for non-preflighted requests it's fine to include client certificates..
[1] https://fetch.spec.whatwg.org/#cors-protocol-and-credentials https://fetch.spec.whatwg.org/#cors-protocol-and-credentials
- Elucalidavah 3y ago> servers behind mTLS authenticated proxy Shouldn't it be possible to configure the proxy to accept any OPTIONS request (i.e. require&validate the client cert after the request headers are passed)?
- bawolff 3y agoHonestly that seems reasonable to me. Makes much more sense than the alternative imo.
- kreetx 3y agoThe issue is that if you do have the client certificate, then (as sibling suggests) now you need to configure your proxy to decide on how to reply to pre-flight requests. Doable but application logic has now leaked into proxy configuration. Another workaround is to use a non-preflighted request, i.e POST with multipart for sending larger amounts of data. Yuck! Why can't I talk application/json to my cross-origin mTLS service as a normal person? :)
- bawolff 3y agoBut if you are using mTLS for authentication, you probably don't want random websites to connect with the certificate.
- kreetx 3y agoYou'll only be able to send client certificates which match the server's CA cert, and if any are found the browser will also prompt you to whether to send it (there'll also be a dropdown when there are more than one).