Live data from Hacker News

Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS

intruder.io

21–27 of 27 posts

Re: Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS

#21

I think the real problem here is that people are writing web servers that don't enforce spec. As soon as a space in a header name is found, a 400 Bad Request needs to be thrown. "Content-Length abcd: 0" is invalid and should never be accepted.

The real problem is text-based protocols, which are naturally quite flexible (and rather inefficient to parse). If HTTP headers were simply a single-byte identifier[1], then e.g. 03 is Content-Length and there's no way to interpret that as anything else. I've made similar comments about such before: https://news.ycombinator.com/item?id=23582056 [1] A single byte is sufficient --- there have been far less than 255 hea…

This is what HTTP/2 does with HPACK compression to compress headers and its "static table" [1] for common headers.

There are 61 headers already defined in this table.

[1] https://httpwg.org/specs/rfc7541.html#static.table.definitio...

Re: Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS

#22

Earlier quoted context omitted.

The real problem is text-based protocols, which are naturally quite flexible (and rather inefficient to parse). If HTTP headers were simply a single-byte identifier[1], then e.g. 03 is Content-Length and there's no way to interpret that as anything else. I've made similar comments about such before: https://news.ycombinator.com/item?id=23582056 [1] A single byte is sufficient --- there have been far less than 255 hea…

> [1] A single byte is sufficient --- there have been far less than 255 headers defined since the beginnings of HTTP; maybe custom ones can be defined in an additional space, but a byte is actually already more than sufficient to convey the same information that would take dozens of bytes in the current text-based protocol. You're probably only talking about ones defined in something like an RFC. I'm pretty sure ther…

I don't see how you can get to more than 255, unless someone is using them in an incredibly stupid way. What really matters is the standard ones that everyone agrees on. The vendor-specific ones can be in their own space (e.g. 8xh and above), and if that's not enough, define an extension mechanism that adds a byte and you get 65535 different ones, which is definitely more than enough.

It's 2021, who cares about dozens of bytes?

That's the sort of attitude that got us Electron and all the other bloated web crap out there. A little bit adds up quickly, especially at the scale of the Internet.

Re: Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS

#23

Earlier quoted context omitted.

> [1] A single byte is sufficient --- there have been far less than 255 headers defined since the beginnings of HTTP; maybe custom ones can be defined in an additional space, but a byte is actually already more than sufficient to convey the same information that would take dozens of bytes in the current text-based protocol. You're probably only talking about ones defined in something like an RFC. I'm pretty sure ther…

I don't see how you can get to more than 255, unless someone is using them in an incredibly stupid way. What really matters is the standard ones that everyone agrees on. The vendor-specific ones can be in their own space (e.g. 8xh and above), and if that's not enough, define an extension mechanism that adds a byte and you get 65535 different ones, which is definitely more than enough. It's 2021, who cares about dozen…

> I don't see how you can get to more than 255, unless someone is using them in an incredibly stupid way. What really matters is the standard ones that everyone agrees on. The vendor-specific ones can be in their own space (e.g. 8xh and above), and if that's not enough, define an extension mechanism that adds a byte and you get 65535 different ones, which is definitely more than enough.

It's kind of ridiculous to argue for a one-byte address space in 2021, then kludging on an extension mechanism to handle the obvious fact that's too small. And even after that, you're still leaving everyone with ints instead of names. So we'll all get to ask ourselves "what header is 3849, again?" way more than we ever should.

That's ignoring the fact that this proposal is totally DOA unless you can find a time machine to go back to 1989 and hit Tim Berners-Lee on the head with a pipe while he was writing the HTTP spec.

>> It's 2021, who cares about dozens of bytes?

> That's the sort of attitude that got us Electron and all the other bloated web crap out there. A little bit adds up quickly, especially at the scale of the Internet.

There's about a light year between worrying about a dozen bytes and something like Electron.

Re: Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS

#25

Earlier quoted context omitted.

I don't see how you can get to more than 255, unless someone is using them in an incredibly stupid way. What really matters is the standard ones that everyone agrees on. The vendor-specific ones can be in their own space (e.g. 8xh and above), and if that's not enough, define an extension mechanism that adds a byte and you get 65535 different ones, which is definitely more than enough. It's 2021, who cares about dozen…

> I don't see how you can get to more than 255, unless someone is using them in an incredibly stupid way. What really matters is the standard ones that everyone agrees on. The vendor-specific ones can be in their own space (e.g. 8xh and above), and if that's not enough, define an extension mechanism that adds a byte and you get 65535 different ones, which is definitely more than enough. It's kind of ridiculous to arg…

It's kind of ridiculous to argue for a one-byte address space in 2021, then kludging on an extension mechanism to handle the obvious fact that's too small.

I'm saying that it's not too small. You still haven't mentioned anything about your use-case of needing several hundred(!?!?) different unique headers. 30 years of HTTP and so far there's been less than 100 defined.

So we'll all get to ask ourselves "what header is 3849, again?" way more than we ever should.

Note that even those who have only a very vague idea of what HTTP is, know what a 404 is; and probably 403 too.

There's about a light year between worrying about a dozen bytes and something like Electron.

Multiply that dozen bytes by however much traffic goes through the entire Internet... and it suddenly doesn't look small anymore.

Re: Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS

#26

Earlier quoted context omitted.

> I don't see how you can get to more than 255, unless someone is using them in an incredibly stupid way. What really matters is the standard ones that everyone agrees on. The vendor-specific ones can be in their own space (e.g. 8xh and above), and if that's not enough, define an extension mechanism that adds a byte and you get 65535 different ones, which is definitely more than enough. It's kind of ridiculous to arg…

It's kind of ridiculous to argue for a one-byte address space in 2021, then kludging on an extension mechanism to handle the obvious fact that's too small. I'm saying that it's not too small. You still haven't mentioned anything about your use-case of needing several hundred(!?!?) different unique headers. 30 years of HTTP and so far there's been less than 100 defined. So we'll all get to ask ourselves "what header i…

> I'm saying that it's not too small. You still haven't mentioned anything about your use-case of needing several hundred(!?!?) different unique headers. 30 years of HTTP and so far there's been less than 100 defined.

That's not actually my use case. My objection is that you're basically advocating for running a code obfuscator on HTTP requests, which would make them far more painful to work with for very, very little gain.

>> So we'll all get to ask ourselves "what header is 3849, again?" way more than we ever should.

> Note that even those who have only a very vague idea of what HTTP is, know what a 404 is; and probably 403 too.

You're missing the point, numeric codes work there because almost no one defines new HTTP status codes. IIRC, there's maybe two dozen defined and most programmers could probably name only 4 or 5 off the top of their heads. People define new headers all the time.

Ints as identifiers have practically no human meaning at all. Very, very few will know what header 3000 is without looking it up, and because it's an int, when there's a naming collision the meanings will almost certainly be wildly different. It'll be a mess.

> Multiply that dozen bytes by however much traffic goes through the entire Internet... and it suddenly doesn't look small anymore.

Think of is this way: you're wasting bytes in your markup by using long names. Most JSON objects should never need more than 26 variables. How about we restrict variables to single-character strings? It'll save some bytes, and think about how much JSON is zipping around the internet. Ditto with our programs. Lets install a linter on your machine that will fail your builds if you use more than a 1-char variable name.

Also, it's well into the 21st century. Don't you think we should go back to two-digit years for most dates, because bytes?

Re: Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS

#27

I think the real problem here is that people are writing web servers that don't enforce spec. As soon as a space in a header name is found, a 400 Bad Request needs to be thrown. "Content-Length abcd: 0" is invalid and should never be accepted.

The real problem is text-based protocols, which are naturally quite flexible (and rather inefficient to parse). If HTTP headers were simply a single-byte identifier[1], then e.g. 03 is Content-Length and there's no way to interpret that as anything else. I've made similar comments about such before: https://news.ycombinator.com/item?id=23582056 [1] A single byte is sufficient --- there have been far less than 255 hea…

> A single byte is sufficient

Just use variable length encodings like LEB 128

Post reply on HN