rack-protection: Don't track the Accept-Language header by default #1504
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Update: The CI failure seems unrelated to changes in this branch. All tests pass on my local machine. |
Some modern browsers (e.g., Safari 12, Chrome 71) don't set the Accept-Language header for websocket requests. A mixture of requests with and without this header results in unavailable sessions in websocket handlers due to the built-in Firesheep protection. The existing default is inappropriate for any applications employing Rack sessions for websocket connections.
temochka
force-pushed
the
websocket-empty-sessions
branch
from
ff964d5 to
6cf49c8
Compare
namusyaka
approved these changes
Dec 15, 2018
|
Thanks, @namusyaka! 🎉 |
netbsd-srcmastr
pushed a commit
to NetBSD/pkgsrc
that referenced
this pull request
Mar 20, 2020
Update ruby-rack-protection to 2.0.8.1. ### rack-protection * Don't track the Accept-Language header by default [#1504](sinatra/sinatra#1504) by Artem Chistyakov
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The existing default is inappropriate for any applications that accept websocket connections.
Some browsers (e.g., Safari 12, Chrome 71) don't set the
Accept-Languageheader for websocket requests. A mixture of requests with and without this header results in unavailable sessions in websocket handlers. This affects both Sinatra apps and other websocket apps using rack-protection in their middleware stack.Considering the partial nature ("this will not prevent determined hijacking attempts") of the employed defense mechanism and current proliferation of TLS support on the web, I propose relaxing the defaults (the attached patch) or disabling the middleware altogether (happy to help with that too).
Attaching request dumps for 3 modern browsers retrieved by running
socket = new WebSocket("ws://localhost:4669")from the Developer Console against a local netcat server (nc -l 127.0.0.1 4669).Safari 12:
Chrome 71:
Firefox 63: