4 ms·
I don't agree on WEBricks verbose headers being a problem. It should not be used in production anyway and during development getting lots information easily is
by symmetricsaurus 14y ago
I don't agree on WEBricks verbose headers being a problem. It should not be used in production anyway and during development getting lots information easily is obviously very useful.
- heidar 14y agoEven if used in production, isn't hiding the headers security through obscurity?
- mnarayan01 14y agoPrecise version information (in production) is probably not a good idea; obscuring the fact that you're insecure has obvious upsides.
- garethadams 14y agoMaybe you should present headers from some older, more insecure server? Then any script using the Server headers to target specific vulnerabilities will be completely foiled!
- pjungwir 14y agoI was surprised they considered this an issue also. Does anyone here run WEBrick in production? Similarly for binding on 0.0.0.0. If you're running Passenger or Unicorn, this shouldn't be a problem. I don't know about other projects like Thin. But insofar as this is something the core Rails team has control over, we're talking about just WEBrick again, right?
- InAnEmergency 14y agoWhen the recent RCE exploits came out, the idea of a bunch of people running Rails dev environments on their laptops on 0.0.0.0:3000 became a lot scarier. Even if an intruder getting into a corporate network and scanning for Rails apps sounds unlikely, there are plenty of opportunities on public networks (e.g. all those Rails hipsters at coffeeshops).
- pjungwir 14y agoPeople developing apps in coffeeshops is a serious threat, you're right. Edit: Sorry if anyone thought this was supposed to be sarcastic; it wasn't.
- Xylakant 14y agoThe nasty thing was that no "getting into corporate network and scanning" was required. All you had to manage was to get some browser to send a maliciously crafted request to a vulnerable app. It's easy to just have a snippet of javascript code that just posts to localhost:3000 in the hope of hitting an app. Embed that snippet on a forum that lots of rails developers visit - instant pwnage. It's spray and pray, granted, but as long as you're not trying to hit a specific target that should give you plenty of root shells on developer machines.
- InAnEmergency 14y agoGood point, even better.
- steveklabnik 14y agoAnyone who does not specify a web sever in the Gemfile and deploys to Heroku is running WEBrick in production.
- pjungwir 14y agoReally? I can't find anything one way or another on the Cedar stack, but on the old Bamboo stack they used Thin.
- michaelbuckbee 14y agoCedar default is webrick - I only know this because I had to switch to Thin (and then later Unicorn) to deal with some issues on an app on Cedar stack.
- robotmay 14y agoI will admit to accidentally running it in production when I forgot to put a different server in the Gemfile. I was being pretty thick that day.