6 ms·
> The current way to protect against these attacks is to ensure a size limit on incoming requests. This can be more difficult than you may expect - Paul points
by CodeWriter23 2y ago
> The current way to protect against these attacks is to ensure a size limit on incoming requests. This can be more difficult than you may expect - Paul points out that alternative paths such as WebSockets might bypass limits that are in place for regular HTTP requests, plus some servers may apply limits before decompression, allowing an attacker to send a compressed payload that is larger than the configured limit.
Interesting...a security researcher that thinks it's ok to trust the client.
- cma 2y agoHe says it's more difficult than you might expect not to.
- CodeWriter23 2y agoI think that's an artifact of the problem statement. For example, "length check while receiving or in the process of decompressing" eliminates things like websockets from the equation entirely.
- Stefan-H 2y agoWhat part of that do you interpret as trusting the client?
- CodeWriter23 2y ago> Paul points out that alternative paths such as WebSockets might bypass limits that are in place for regular HTTP requests <
- zbentley 2y agoI'm not sure I interpret that as trusting the client; rather, it seems like the implication is that HTTP limits will be handled correctly by webserver harnesses, whereas WebSockets may not get any such behavior "for free" from the server framework.
- echoangle 2y agoHe’s saying that some Webservers allow you to limit request size, but the limits you set might only apply to HTTP(S) and can be circumvented when using another protocol. That’s a server side problem.
- Sohcahtoa82 2y agoIs English not your first language? If it is, I am utterly baffled as how you think that's an endorsement trusting the client, rather than merely a description.
- root_axis 2y agoHe's saying the opposite. His point is that adding in a request limit in your server config may not be enough because protocols like websocket might not inherit those size restrictions automatically due to specialized logic for implementing sockets over http.