search

WICG / private-network-access

https://wicg.github.io/private-network-access/
Other
52 stars 21 forks source link

WebSockets / WebRTC / WebTransport #32

Open annevk opened 3 years ago

annevk commented 3 years ago

I'm curious where the hook for CORS RFC1918 should be. Is it primarily about HTTP connections, or is it about protecting specific IP addresses in general from web traffic?

letitz commented 3 years ago

I think the most important is preventing HTTP connections, because private websites are most likely to be exploited via HTTP requests. Preventing any web traffic is probably a tad bit less important, but still useful - one can imagine buggy servers mishandling malicious malformed data, or even vulnerable websocket server implementations.

I have not yet formed an opinion regarding WebRTC and WebTransport.

annevk commented 3 years ago

WebSocket is essentially an HTTP connection, so it would have to be covered.

WebTransport uses ALPN so maybe that is fine indeed. We would need to make it very clear that not all browser connections to these network addresses are preflighted.

Unsure about WebRTC as well, but looking into it.

annevk commented 3 years ago

Given that we had to expand port blocking to WebRTC, it would make sense to me that this also applies there.