Subject: ext#9: OppSec and Proxies

From: Mark Nottingham <[email-masked]>
Date: Wed, 2 Jul 2014 16:26:32 +1000

<https://github.com/httpwg/http-extensions/issues/9>

We need to define how a client using OppSec connects to a configured proxy; e.g., does it CONNECT, or does it downgrade? Does the answer change if the proxy is http vs https? Can the proxy advertise OppSec?

--
Mark Nottingham   https://www.mnot.net/

---

From: "Richard Wheeldon (rwheeldo)" <[email-masked]>
Date: Wed, 2 Jul 2014 09:39:47 +0000

From: Mark Nottingham [mailto:[email-masked]] 
 > Can the proxy advertise OppSec?

I'd really like the answer to this to be "yes". Consider a typical network layout for a guy in a coffee shop using his laptop:

	Client --- < Wifi > --- < ISPs > --- < Proxy > --- < ISPs > --- < Server >

The Wifi part of the picture is the dodgy part. That's the area of high latency, low bandwidth and high risk of direct attack (e.g. stolen credentials, malware, data loss and personal attacks as opposed to NSA style monitoring). Cisco have a product called AnyConnect which is a pretty popular VPN client. Less well known is that it also has a mode in which all Web traffic is sent to Cloud Web Security (the big proxy in the cloud). Since it's designed to be used on laptops in these sort of scenarios, it upgrades all connections to TLS for security. However, this requires custom software on the endpoint with a client that knows a lot less about page structure and user-activity than the browser does. It'd be much neater, faster and cleaner if we could just kick the browser into doing HTTP/2 over TLS and leave the client as a dumb bit-mover. Similar arguments can be made for other proxies,

Regards,

Richard

---

From: Patrick McManus <[email-masked]>
Date: Wed, 2 Jul 2014 11:09:25 -0400

On Wed, Jul 2, 2014 at 2:26 AM, Mark Nottingham <[email-masked]> wrote:

> We need to define how a client using OppSec connects to a configured proxy

I'm not sure we need to define one path. It seems like a trust and policy
decision where it is sufficient to describe the mechanisms. Both proxying
and tunneling are sensible under different circumstances .

> Does the answer change if the proxy is http vs https?

That's one input. Another is the trust relationship you have with the proxy
and another might be the backend protocol capabilities of the intermediary.
(i.e. does it do OppSec as a client? does it do >= the client protocol
version, etc..)

> Can the proxy advertise OppSec?
devil is in the details - but generically: yes that's desirable