{"action":"created","issue":{"url":"https://api.github.com/repos/EricssonResearch/Blind-Cache-Drafts/issues/3","repository_url":"https://api.github.com/repos/EricssonResearch/Blind-Cache-Drafts","labels_url":"https://api.github.com/repos/EricssonResearch/Blind-Cache-Drafts/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/EricssonResearch/Blind-Cache-Drafts/issues/3/comments","events_url":"https://api.github.com/repos/EricssonResearch/Blind-Cache-Drafts/issues/3/events","html_url":"https://github.com/EricssonResearch/Blind-Cache-Drafts/issues/3","id":145281781,"number":3,"title":"Prevent CDN Exploitation","user":{"login":"MikeBishop","id":4273797,"avatar_url":"https://avatars.githubusercontent.com/u/4273797?v=3","gravatar_id":"","url":"https://api.github.com/users/MikeBishop","html_url":"https://github.com/MikeBishop","followers_url":"https://api.github.com/users/MikeBishop/followers","following_url":"https://api.github.com/users/MikeBishop/following{/other_user}","gists_url":"https://api.github.com/users/MikeBishop/gists{/gist_id}","starred_url":"https://api.github.com/users/MikeBishop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MikeBishop/subscriptions","organizations_url":"https://api.github.com/users/MikeBishop/orgs","repos_url":"https://api.github.com/users/MikeBishop/repos","events_url":"https://api.github.com/users/MikeBishop/events{/privacy}","received_events_url":"https://api.github.com/users/MikeBishop/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-04-01T20:47:14Z","updated_at":"2016-05-04T01:39:19Z","closed_at":null,"body":"The current model contains no proof for the CDN that the origin actually referred it.  7.2 defines using the encryption/integrity keys as proof *to the client* that the origin actually can decrypt the content.  An attacker who wished to spoof the origin could not only retrieve and rehost the content, but even use the same CDN address and key to steal the CDN's hosting services for its attack.\r\n\r\nIt seems like there needs to be something to demonstrate to the CDN that the requestor has (recently?) spoken to the origin server."},"comment":{"url":"https://api.github.com/repos/EricssonResearch/Blind-Cache-Drafts/issues/comments/216717718","html_url":"https://github.com/EricssonResearch/Blind-Cache-Drafts/issues/3#issuecomment-216717718","issue_url":"https://api.github.com/repos/EricssonResearch/Blind-Cache-Drafts/issues/3","id":216717718,"user":{"login":"martinthomson","id":67641,"avatar_url":"https://avatars.githubusercontent.com/u/67641?v=3","gravatar_id":"","url":"https://api.github.com/users/martinthomson","html_url":"https://github.com/martinthomson","followers_url":"https://api.github.com/users/martinthomson/followers","following_url":"https://api.github.com/users/martinthomson/following{/other_user}","gists_url":"https://api.github.com/users/martinthomson/gists{/gist_id}","starred_url":"https://api.github.com/users/martinthomson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinthomson/subscriptions","organizations_url":"https://api.github.com/users/martinthomson/orgs","repos_url":"https://api.github.com/users/martinthomson/repos","events_url":"https://api.github.com/users/martinthomson/events{/privacy}","received_events_url":"https://api.github.com/users/martinthomson/received_events","type":"User","site_admin":false},"created_at":"2016-05-04T01:39:19Z","updated_at":"2016-05-04T01:39:19Z","body":"The main risk here is that a browser client uses ambient authority to access a resource and then unwittingly passes that content to an origin that wouldn't otherwise be able to access the content.  That is, the user has a cookie that the attacking origin does not, but this would allow the attacking origin to get that content.  In this case, the client is acting in good faith and can be assumed to use Origin.  Otherwise, the attacker has complete control over the request, but they also need to find the cookie.\r\n\r\nWe have several protections working here: Origin (which requires that the cache check it, so it's weak), that the attacker doesn't know the cookies, and that the primary resource has to \"prove\" that it knows what the cache holds."}}