Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Careful mode for proxying #48

Open
tailhook opened this issue Aug 2, 2017 · 0 comments
Open

Careful mode for proxying #48

tailhook opened this issue Aug 2, 2017 · 0 comments

Comments

@tailhook
Copy link
Collaborator

tailhook commented Aug 2, 2017

There are some servers that don't obey non-body receiving responses, including:

  1. Sending 0-length chunk on 304 Not Modified
  2. Sending full response body in HEAD requests
  3. Sometimes nginx forwards zero-length chunk but strips transfer-encoding at all (see Swindon behavior with 304 (and possible other response codes) #47)

(maybe other, but at least 204 codes should be immune to the attack).

While (1) only creates errors for some clients, (2) can really be source of cache-poisoning attacks. So we might want more careful mode for keep-alive/pipelineing:

  1. Do not pipeline HEAD requests
  2. No not pipeline If-Modifed-Since and If-None-Match requests, 304 response codes.

The alternative is to disable keep-alive by default as nginx does. Another thing is we need some test suite to determine whether service behind swindon does proxying correctly. And the test suite is hard to do because the service might have some complex routing (i.e. serving static files under certain urls, serving streaming updates under certain urls), or be non-validating proxy itself (i.e. depend on the services behind for correctness).

Inspired by #47.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant