News for hackers. Stuff that matters.
Re:Firefox and Fastly take another step toward a privacy upg... by TradingPlaces on Thursday October 12, 2023 @06:37PM (#37864046)
>However, the key difference is that in OHTTP the end destination is known, because there is a 1-1-1 mapping between OHTTP Relay -> OHTTP Gateway -> Target. This could become more generalized in future revisions to OHTTP, but right now it's all hardcoded behavior.

So the Relay knows the requested URL? That’s not masked by the client?

Re:Firefox and Fastly take another step toward a privacy upg... by zeroentropy on Thursday October 12, 2023 @06:41PM (#37864088)
OHTTP encapsulates a complete request, so the 1-1-1 mapping isn't right. The target can be any resource, but it generally should be on the same host/origin as the gateway. The gateway sees the request and the response, so there are very few cases where you would trust it to handle requests for any URL.
Re:Firefox and Fastly take another step toward a privacy upg... by TradingPlaces on Thursday October 12, 2023 @07:03PM (#37864309)
Thanks
Re:Firefox and Fastly take another step toward a privacy upg... by skuhn on Thursday October 12, 2023 @07:42PM (#37864609)
Yes, that's true. However in practice most deployments that I've worked on are a relay which maps all requests to a gateway which maps all requests to a target. It's not an inherent property of the protocol, and I expect that to evolve over time.
Re:Firefox and Fastly take another step toward a privacy upg... by skuhn on Thursday October 12, 2023 @07:45PM (#37864636)
The Relay doesn't know the requested URL or the request body -- but it does know the next-hop destination (the OHTTP Gateway), and by virtue of the way most OHTTP services are currently deployed this tells you the destination service. It does not tell you the specific details of what is being asked for / returned by that service.
Re:Firefox and Fastly take another step toward a privacy upg... by TradingPlaces on Thursday October 12, 2023 @08:28PM (#37864967)
Thanks