News for hackers. Stuff that matters.
Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by userbinator on Thursday November 11, 2021 @07:17PM (#29194930)
The real problem is text-based protocols, which are naturally quite flexible (and rather inefficient to parse). If HTTP headers were simply a single-byte identifier[1], then e.g. 03 is Content-Length and there's no way to interpret that as anything else. I've made similar comments about such before: https://news.ycombinator.com/item?id=23582056

[1] A single byte is sufficient --- there have been far less than 255 headers defined since the beginnings of HTTP; maybe custom ones can be defined in an additional space, but a byte is actually already more than sufficient to convey the same information that would take dozens of bytes in the current text-based protocol.

Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by tablespoon on Thursday November 11, 2021 @09:49PM (#29195829)
> [1] A single byte is sufficient --- there have been far less than 255 headers defined since the beginnings of HTTP; maybe custom ones can be defined in an additional space, but a byte is actually already more than sufficient to convey the same information that would take dozens of bytes in the current text-based protocol.

You're probably only talking about ones defined in something like an RFC. I'm pretty sure there are far more than 255 different HTTP headers in use just by my employer's in-house stuff.

> more than sufficient to convey the same information that would take dozens of bytes in the current text-based protocol

It's 2021, who cares about dozens of bytes? I'd wager that's far less than 1% of the size of most HTTP exchanges, and it means generic tooling can actually show you something useful for all that custom stuff it's guaranteed not to know the specifics of.

Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by userbinator on Friday November 12, 2021 @12:04AM (#29196455)
I don't see how you can get to more than 255, unless someone is using them in an incredibly stupid way. What really matters is the standard ones that everyone agrees on. The vendor-specific ones can be in their own space (e.g. 8xh and above), and if that's not enough, define an extension mechanism that adds a byte and you get 65535 different ones, which is definitely more than enough.

It's 2021, who cares about dozens of bytes?

That's the sort of attitude that got us Electron and all the other bloated web crap out there. A little bit adds up quickly, especially at the scale of the Internet.

Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by tablespoon on Friday November 12, 2021 @12:21AM (#29196528)
> I don't see how you can get to more than 255, unless someone is using them in an incredibly stupid way. What really matters is the standard ones that everyone agrees on. The vendor-specific ones can be in their own space (e.g. 8xh and above), and if that's not enough, define an extension mechanism that adds a byte and you get 65535 different ones, which is definitely more than enough.

It's kind of ridiculous to argue for a one-byte address space in 2021, then kludging on an extension mechanism to handle the obvious fact that's too small. And even after that, you're still leaving everyone with ints instead of names. So we'll all get to ask ourselves "what header is 3849, again?" way more than we ever should.

That's ignoring the fact that this proposal is totally DOA unless you can find a time machine to go back to 1989 and hit Tim Berners-Lee on the head with a pipe while he was writing the HTTP spec.

>> It's 2021, who cares about dozens of bytes?

> That's the sort of attitude that got us Electron and all the other bloated web crap out there. A little bit adds up quickly, especially at the scale of the Internet.

There's about a light year between worrying about a dozen bytes and something like Electron.

Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by userbinator on Friday November 12, 2021 @09:33AM (#29199594)
It's kind of ridiculous to argue for a one-byte address space in 2021, then kludging on an extension mechanism to handle the obvious fact that's too small.

I'm saying that it's not too small. You still haven't mentioned anything about your use-case of needing several hundred(!?!?) different unique headers. 30 years of HTTP and so far there's been less than 100 defined.

So we'll all get to ask ourselves "what header is 3849, again?" way more than we ever should.

Note that even those who have only a very vague idea of what HTTP is, know what a 404 is; and probably 403 too.

There's about a light year between worrying about a dozen bytes and something like Electron.

Multiply that dozen bytes by however much traffic goes through the entire Internet... and it suddenly doesn't look small anymore.

Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by tablespoon on Friday November 12, 2021 @10:46AM (#29200432)
> I'm saying that it's not too small. You still haven't mentioned anything about your use-case of needing several hundred(!?!?) different unique headers. 30 years of HTTP and so far there's been less than 100 defined.

That's not actually my use case. My objection is that you're basically advocating for running a code obfuscator on HTTP requests, which would make them far more painful to work with for very, very little gain.

>> So we'll all get to ask ourselves "what header is 3849, again?" way more than we ever should.

> Note that even those who have only a very vague idea of what HTTP is, know what a 404 is; and probably 403 too.

You're missing the point, numeric codes work there because almost no one defines new HTTP status codes. IIRC, there's maybe two dozen defined and most programmers could probably name only 4 or 5 off the top of their heads. People define new headers all the time.

Ints as identifiers have practically no human meaning at all. Very, very few will know what header 3000 is without looking it up, and because it's an int, when there's a naming collision the meanings will almost certainly be wildly different. It'll be a mess.

> Multiply that dozen bytes by however much traffic goes through the entire Internet... and it suddenly doesn't look small anymore.

Think of is this way: you're wasting bytes in your markup by using long names. Most JSON objects should never need more than 26 variables. How about we restrict variables to single-character strings? It'll save some bytes, and think about how much JSON is zipping around the internet. Ditto with our programs. Lets install a linter on your machine that will fail your builds if you use more than a 1-char variable name.

Also, it's well into the 21st century. Don't you think we should go back to two-digit years for most dates, because bytes?

Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by chtitux on Friday November 12, 2021 @12:01AM (#29196442)
This is what HTTP/2 does with HPACK compression to compress headers and its "static table" [1] for common headers.

There are 61 headers already defined in this table.

[1] https://httpwg.org/specs/rfc7541.html#static.table.definitio...

Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by jamesfinlayson on Thursday November 11, 2021 @09:35PM (#29195740)
That'd be nice - no uppercase/lowercase mixups (or the need to support Referer and Referrer).
Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by chii on Thursday November 11, 2021 @07:37PM (#29195052)
so you're just describing what amounts to packets, which is basically like udp or tcp.

The reason http is good is due to the text nature (along with whatever drawbacks associated with it being text).

Re:Practical HTTP Header Smuggling: Sneaking Past Reverse Pr... by legulere on Saturday November 13, 2021 @05:52AM (#29208927)
> A single byte is sufficient

Just use variable length encodings like LEB 128