Warn on port spoofing /7 #29463
Warn on port spoofing /7 #29463
Conversation
Isn't the concern beyond just port spoofing to include the host as well? ... or did you want it with a slash there ... "host/port spoofing"?
I'm not clear on why that would work. I didn't see that that was a solution in dotnet/aspnetcore#46057. |
|
@guardrex check my last commit on host/porr and suggest better wording.
The PU will likely nix that but I thought I'd add it. It doesn't prevent authorized hosts from spoofing, just unauthorized, lol. |
guardrex
left a comment
guardrex
left a comment
There was a problem hiding this comment.
I'm cool, except for this line ...
To prevent unauthorized clients from spoofing the port, call xref:Microsoft.AspNetCore.Builder.AuthorizationEndpointConventionBuilderExtensions.RequireAuthorization%2A:
... just because I don't think that's going to work.
Co-authored-by: Luke Latham <[email protected]>
| To prevent unauthorized clients from spoofing the port, call <xref:Microsoft.AspNetCore.Builder.AuthorizationEndpointConventionBuilderExtensions.RequireAuthorization%2A>: | ||
|
|
||
| :::code language="csharp" source="~/host-and-deploy/health-checks/samples/7.x/HealthChecksSample/Snippets/Program.cs" id="snippet_MapHealthChecksRequireHostPortAuth"::: |
There was a problem hiding this comment.
Should this be removed?
@JamesNK will decide. It prevents unauthorized clients from port spoofing, but not authorized clients. |
Co-authored-by: Luke Latham <[email protected]>
|
I'm not familiar with this attack or workaround. I'm not the right person to review. |
Co-authored-by: Chris Ross <[email protected]>
* Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Update aspnetcore/includes/spoof.md Co-authored-by: Luke Latham <[email protected]> * Apply suggestions from code review Co-authored-by: Luke Latham <[email protected]> * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Update aspnetcore/includes/spoof.md Co-authored-by: Chris Ross <[email protected]> --------- Co-authored-by: Luke Latham <[email protected]> Co-authored-by: Chris Ross <[email protected]>
Fixes #29399
Solution from dotnet/aspnetcore#46057
Internal review URLS:
Internal previews