Subject: [http-extensions] Attacks from same host (#144)

From: HTTP issue updates <[email-masked]>
Date: Fri, 05 Feb 2016 18:02:14 -0800

When an attacker has the ability to:

1) inject a HTTP header in any response from an origin
2) listen to a port on the same host

they can effectively hijack the origin, for browsers that implement OppSec.

E.g., someone on a shared Web host that also offers shell access.

Previously, Alt-Svc used the port number as a way to mitigate this; however, in #139 we dropped that, because on many systems this is no longer a meaningful way to segment privileged applications. 

In discussion, it was suggested that the origin should opt into OppSec explicitly, e.g., with a `.well-known` file. 

---
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/144