3 ms·
I understand that security needs to be pragmatic, but because security does it, doesn't make it right. It isn't about being in the enclave, it is having to kee
by sitkack 2y ago
I understand that security needs to be pragmatic, but because security does it, doesn't make it right.
It isn't about being in the enclave, it is having to keep track of what headers you set vs external. It is fragile and error prone and it will absolutely break someone else when there is a name collision.
All security exploits are a subset of bugs.
- hinkley 2y agoAnd what would you have them do instead? SSL to every service? Reauthenticate on every single call? What’s your clever solution? There’s probably a dozen things you can terminate at a boundary that would cost so much to run through the entire system that it would bankrupt a company. And then there’s tracing, which also uses headers.
- immibis 2y agoone of the listed options was to begin all the Cloudflare internal header names with "CFInt"
- hinkley 2y agoThat’s still header filtering. And it should be X-CF- by the way.
- amluto 2y agoX-CF- seems to be used by some other software. And Cloudflare has plenty of documented headers that don’t start with X. The whole point is that a genuine user header should never conflict with a Cloudflare internal header, and a browser should never see an internal header.
- hinkley 2y agoPlease reread the entire thread. We are talking about someone who thinks the header solution is stupid. You are both splitting hairs. Stay on target.
- sitkack 2y agoHaving re-read the thread, I totally agree. What you have listed is table stakes. I'd also say that internal headers would also be encrypted to a narrow protection domain. If all internal headers were prefixed with X-CF-, you could strip them all via SIMD that had no knowledge of any specific header. Hell, you could probably do it on the NIC.
- faitswulff 2y agoIt took me about 10 years to hear about it, but the IETF tried to deprecate the X- prefix back in 2012: https://datatracker.ietf.org/doc/html/rfc6648 https://datatracker.ietf.org/doc/html/rfc6648
- hinkley 2y agoGood to know. (Also sibling is right, I spaced on X-CF- being a header sent to CF customers’ servers. I don’t used cloudflare but cloudfront does the exact same thing)
- 8n4vidtmkvmk 2y agoMaybe I'm dumb or missing something, but why not just do what Google does -- convert all inbound HTTP requests into Protobufs, separate out the internal stuffs from the external stuffs, run it through your myriad of internal services, and then on the way out you still have your nicely delineated protobufs which you can convert back into HTTP. Why are we mucking about with headers in the first place?