Conversation
Isn't the concern beyond just port spoofing to include the host as well? ... or did you want it with a slash there ... "host/port spoofing"?
I'm not clear on why that would work. I didn't see that that was a solution in dotnet/aspnetcore#46057. |
|
@guardrex check my last commit on host/porr and suggest better wording.
The PU will likely nix that but I thought I'd add it. It doesn't prevent authorized hosts from spoofing, just unauthorized, lol. |
guardrex
left a comment
There was a problem hiding this comment.
I'm cool, except for this line ...
To prevent unauthorized clients from spoofing the port, call xref:Microsoft.AspNetCore.Builder.AuthorizationEndpointConventionBuilderExtensions.RequireAuthorization%2A:
... just because I don't think that's going to work.
Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com>
| To prevent unauthorized clients from spoofing the port, call <xref:Microsoft.AspNetCore.Builder.AuthorizationEndpointConventionBuilderExtensions.RequireAuthorization%2A>: | ||
|
|
||
| :::code language="csharp" source="~/host-and-deploy/health-checks/samples/7.x/HealthChecksSample/Snippets/Program.cs" id="snippet_MapHealthChecksRequireHostPortAuth"::: |
There was a problem hiding this comment.
Should this be removed?
@JamesNK will decide. It prevents unauthorized clients from port spoofing, but not authorized clients. |
Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com>
|
I'm not familiar with this attack or workaround. I'm not the right person to review. |
Co-authored-by: Chris Ross <chrross@microsoft.com>
* Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Update aspnetcore/includes/spoof.md Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com> * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Warn on port spoofing /7 * Update aspnetcore/includes/spoof.md Co-authored-by: Chris Ross <chrross@microsoft.com> --------- Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com> Co-authored-by: Chris Ross <chrross@microsoft.com>
Fixes #29399
Solution from dotnet/aspnetcore#46057
Internal review URLS:
Internal previews