jdev - 2021-12-27

https://xmpp.org/extensions/xep-0363.html#request What's the rationale for limiting headers to these 3 only?

(Authorization, Cookie, Expires)

pep.: to limit the evil that can be done by a server

The server can return any address for the upload, including things like LAN addresses. Some HTTP implementation security flaws can be exploited through header manipulation. ✏

A server running on a LAN would return a LAN address...

evil server doing evil things via their client, through a quite small attack surface

So if tomorrow I need to pass Foo: bar because my server requires it, @#$% me?

yes.

"640K is enough for everyone" ish

the alternative would've been to depend '363 on CORS

which nobody wanted

because you need to get consent from the receiving domain that the "sending" domain (your XMPP server) is allowed to formulate a request (via the client) to that domain

which is what CORS is all about

nobody wants CORS in XMPP

hence, keep it simple

Just use the standard solution to all HTTP problems: Add another reverse proxy.

how would that help?

oh, the xmppd being one, yes

The proxy can add that header.

> So if tomorrow I need to pass Foo: bar

or it could transform Cookie/Authorization to that header, indeed

or ?query stuff

sure

pep., also, given the number of stupid plastic routers and stuff like log4shell, I wouldn't consider the attack surface small.

Right so considering the server evil is now a norm I guess?

Meh

HTTP Upload again, multiple times the same header seems to be unspecified?

in which way?

<put><header name="Authorization">Foo</header><header name="Authorization">Bar</header></put

in which way does this need extra specification?

Thanks to the wonders of HTTP, that is equivalent to `Authorization: Foo, Bar` except when it isn't

including both is perfectly valid in HTTP ✏

I just realized it's written nowhere that one must forward headers to the put url, I think. It's written that one must ignore other headers and must not include them in the http request

Maybe it could also be hinted that http handles multiple headers just fine

"just fine" (I hear)

"the server providing the headers will know what it's doing, eh"

If you control both the client and server, you can of course use forbidden headers all you want