From 5380f8178b43c410e24a3767dfd12a8ffff98a40 Mon Sep 17 00:00:00 2001 From: Daniel Gultsch Date: Tue, 18 Dec 2018 17:40:47 +0100 Subject: [PATCH] XEP-0363: Added security consideration regarding proper isolation --- xep-0363.xml | 101 ++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 95 insertions(+), 6 deletions(-) diff --git a/xep-0363.xml b/xep-0363.xml index 1f59ce4f..81a88837 100644 --- a/xep-0363.xml +++ b/xep-0363.xml @@ -30,6 +30,18 @@ daniel@gultsch.de daniel@gultsch.de + + 0.9.0 + 2018-12-18 + dg + +
    +
  • Divided Security Considerations into multiple sub sections and added information about properly isolating the HTTP Upload service
    • +
  • Added schema
    • +
  • Added example for CORS header
    • +
+ + 0.8.0 2018-12-10 @@ -306,14 +318,35 @@

The upload service SHOULD choose an appropriate timeout for the validity of the PUT URL. Since there is no reason for a client to wait between requesting the slot and starting the upload, relatively low timeout values of around 300s are RECOMMENDED.

To make HTTP Upload work in web clients (including those hosted on a different domain) the upload service SHOULD set appropriate CORS-Headers. The exact headers and values are out of scope of this document but may include: Access-Control-Allow-Origin, Access-Control-Allow-Methods and Access-Control-Allow-Headers. For HTTP upload services that use custom Authorization or Cookie request header the CORS-Header Access-Control-Allow-Credentials might also be of importance.

+ -
    -
  • Implementors should keep in mind, that without additional end-to-end-encryption, files uploaded to a service described in this document may be stored in plain text. Client implementors are advised to either use this only for semi public files (for example files shared in a public MUC or a PEP Avatar) or implement appropriate end-to-end encryption.
    • -
  • Requesting entities MUST strip any newline characters from the HTTP header names and values before making the PUT request.
    • -
  • Requesting entities MUST ensure that only the headers that are explicitly allowed by this XEP (Authorization, Cookie, Expires) are copied from the slot response to the HTTP request.
    • -
  • Service implementors SHOULD use long randomized parts in their URLs making it impossible to guess the location of arbitrary files
    • + +

    Note: This section is not normative; it may be updated when general web security recommendations change in the future.

    +

    It is recommended to run the HTTP upload domain used for GET requests in appropriate isolation from other HTTP based services to avoid user-generated, malicious scripts to be executed in the context of said services. Isolation techniques can include, but are not limited to, setting the Content-Security-Policy.

    + +

    The provided policy will prohibit a browser from executing all active content from the HTTP upload domain (default-src 'none') and forbid embedding it from other pages (frame-ancestors 'none'). More information on Content-Security-Policy can be found on infosec.mozilla.org.

    +

    Further isolation can be achieved by hosting those files on an entirely different domain instead of using subdomains.

    +     + +
      +
    • Requesting entities MUST strip any newline characters from the HTTP header names and values before making the PUT request.
      • +
    • Requesting entities MUST ensure that only the headers that are explicitly allowed by this XEP (Authorization, Cookie, Expires) are copied from the slot response to the HTTP request.
      • +
    +     + +
      +
    • Service implementors SHOULD use long randomized parts in their URLs making it impossible to guess the location of arbitrary files.
      • +
    • Implementors should keep in mind, that without additional end-to-end-encryption, files uploaded to a service described in this document may be stored in plain text. Client implementors are advised to either use this only for semi public files (for example files shared in a public MUC or a PEP Avatar) or implement appropriate end-to-end encryption.
    +

    This document requires no interaction with the Internet Assigned Numbers Authority (IANA).

    @@ -328,6 +361,62 @@     -

    tbd

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +]]>