You currently send JSON messages such as
{
"s2c" : "alk12asdasdASDasda123=="
}
but it would be nice to have one layer extra, making very clear that data originates from HTTP,
{
"http" : {
"s2c" : "alk12asdasdASDasda123=="
}
}
This enables extra information to be carried over from the browser. Specifically useful would be the following additional information to enable standardised channel binding information:
{
"http" : { ... },
"channel-binding" : [
{ "tls-server-end-point" : "...tls-server-certificate..." }
]
}
Note that an array is used, so it is possible to add new Channel Binding mechanisms. Browsers have no standard for it yet, but the tls-unique mechanism is much stronger than the one shown here, tls-server-end-point, which is often available. The tls-unique mechanism is specific for one TLS session (it incorporates a unique bit from the TLS handhake) whereas tls-server-end-point merely distributes the server certificate, making it only distinguish between servers' certificates. Both forms of Channel Binding add value, however, in making it more difficult to steal a SASL exchange and reuse/abuse it elsewhere; think of rogue clients acting as a proxy to get in.
You currently send JSON messages such as
but it would be nice to have one layer extra, making very clear that data originates from HTTP,
This enables extra information to be carried over from the browser. Specifically useful would be the following additional information to enable standardised channel binding information:
Note that an array is used, so it is possible to add new Channel Binding mechanisms. Browsers have no standard for it yet, but the
tls-uniquemechanism is much stronger than the one shown here,tls-server-end-point, which is often available. Thetls-uniquemechanism is specific for one TLS session (it incorporates a unique bit from the TLS handhake) whereastls-server-end-pointmerely distributes the server certificate, making it only distinguish between servers' certificates. Both forms of Channel Binding add value, however, in making it more difficult to steal a SASL exchange and reuse/abuse it elsewhere; think of rogue clients acting as a proxy to get in.