WebSocket Origin Restriction #9447

BrennanConroy · 2018-11-05T18:48:47Z

Internal Review Link
There are some moniker ranges, so switch the versions to verify they're working

BrennanConroy · 2018-11-05T19:08:30Z

aspnetcore/fundamentals/websockets.md

+});
+```
+
+This helps ensure that browser users are using a trusted client and not a malicious one from a different site.


Review: Should we keep this or remove it?

Remove from here, but consider working it into the section intro.

tdykstra

Looks good, a few comments on style issues.

tdykstra · 2018-11-05T19:13:46Z

aspnetcore/fundamentals/websockets.md

 The following settings can be configured:

 * `KeepAliveInterval` - How frequently to send "ping" frames to the client to ensure proxies keep the connection open.
 * `ReceiveBufferSize` - The size of the buffer used to receive data. Advanced users may need to change this for performance tuning based on the size of the data.
+* `AllowedOrigins`    - List of the Origin header values allowed for WebSocket requests to prevent Cross-Site WebSocket Hijacking. By default all Origins are allowed.


Lowercase Cross-Site and Hijacking

tdykstra · 2018-11-05T19:17:46Z

aspnetcore/fundamentals/websockets.md

+});
+```
+
+This helps ensure that browser users are using a trusted client and not a malicious one from a different site.


Remove from here, but consider working it into the section intro.

tdykstra · 2018-11-05T19:18:17Z

aspnetcore/fundamentals/websockets.md

+```c#
+app.UseWebSockets(new WebSocketOptions()
+{
+    AllowedOrigins.Add("https://client.com");


what's the delimiter for multiple origins?

It's a list so you can call .Add() for as many origins as you want

Show multiple origins (like https://client.com and https://www.client.com) to illustrate that

tdykstra · 2018-11-05T19:24:29Z

aspnetcore/signalr/security.md

@@ -39,6 +39,14 @@ For example, the following CORS policy allows a SignalR browser client hosted on

 ## WebSocket Origin Restriction

+::: moniker range=">= aspnetcore-2.2"
+
+The protections provided by CORS don't apply to WebSockets. For origin restriction on WebSockets read [WebSockets Origin Restriction](xref:fundamentals/websockets#websocket-origin-restriction).


Lowercase origin restriction

tdykstra · 2018-11-05T19:26:45Z

aspnetcore/fundamentals/websockets.md

@@ -123,6 +137,33 @@ The code shown earlier that accepts the WebSocket request passes the `WebSocket`

 When accepting the WebSocket connection before beginning the loop, the middleware pipeline ends. Upon closing the socket, the pipeline unwinds. That is, the request stops moving forward in the pipeline when the WebSocket is accepted. When the loop is finished and the socket is closed, the request proceeds back up the pipeline.

+::: moniker range=">= aspnetcore-2.2"
+
+### WebSocket Origin Restriction


Lowercase origin restriction

sentence case headings; lowercase "origin" except when it refers specifically to "Origin" as the name of a header.

tdykstra · 2018-11-05T19:30:19Z

aspnetcore/fundamentals/websockets.md

+This helps ensure that browser users are using a trusted client and not a malicious one from a different site.
+
+> [!NOTE]
+> The `Origin` header is controlled by the client and, like the `Referer` header, can be faked. These headers should **not** be used as an authentication mechanism.


Or more directly

Do not use these headers as an authentication mechanism.

Could also make that sentence first to make it stand out more.

BrennanConroy · 2018-11-05T20:04:45Z

@tdykstra FYI there are unrelated warnings in the publishing check

tdykstra · 2018-11-05T20:08:00Z

@BrennanConroy Thanks, we're aware of them and are looking into it.

halter73 · 2018-11-05T20:10:18Z

aspnetcore/fundamentals/websockets.md

+The following settings can be configured:
+
+* `KeepAliveInterval` - How frequently to send "ping" frames to the client to ensure proxies keep the connection open.
+* `ReceiveBufferSize` - The size of the buffer used to receive data. Advanced users may need to change this for performance tuning based on the size of the data.


What are the default values?

halter73 · 2018-11-05T22:47:29Z

aspnetcore/fundamentals/websockets.md

+
+* `KeepAliveInterval` - How frequently to send "ping" frames to the client to ensure proxies keep the connection open. The default is two minutes.
+* `ReceiveBufferSize` - The size of the buffer used to receive data. Advanced users may need to change this for performance tuning based on the size of the data. The default is 4kb.
+* `AllowedOrigins`    - List of the Origin header values allowed for WebSocket requests to prevent cross-site WebSocket hijacking. By default all Origins are allowed.


Nit: Uppercase O in "Origin header" seems right, but it should probably be lowercase for "By default, all origins are allowed."

aspnetcore/fundamentals/websockets.md

Co-Authored-By: BrennanConroy <brecon@microsoft.com>

scottaddie · 2018-11-05T23:29:04Z

aspnetcore/fundamentals/websockets.md

-* `KeepAliveInterval` - How frequently to send "ping" frames to the client to ensure proxies keep the connection open.
-* `ReceiveBufferSize` - The size of the buffer used to receive data. Advanced users may need to change this for performance tuning based on the size of the data.
+* `KeepAliveInterval` - How frequently to send "ping" frames to the client to ensure proxies keep the connection open. The default is two minutes.
+* `ReceiveBufferSize` - The size of the buffer used to receive data. Advanced users may need to change this for performance tuning based on the size of the data. The default is 4kb.


kb --> KB

Add space between 4 and KB

scottaddie · 2018-11-05T23:29:42Z

aspnetcore/fundamentals/websockets.md

+The following settings can be configured:
+
+* `KeepAliveInterval` - How frequently to send "ping" frames to the client to ensure proxies keep the connection open. The default is two minutes.
+* `ReceiveBufferSize` - The size of the buffer used to receive data. Advanced users may need to change this for performance tuning based on the size of the data. The default is 4kb.


kb --> KB

Add space between 4 and KB

scottaddie · 2018-11-05T23:30:14Z

aspnetcore/fundamentals/websockets.md

+
+* `KeepAliveInterval` - How frequently to send "ping" frames to the client to ensure proxies keep the connection open. The default is two minutes.
+* `ReceiveBufferSize` - The size of the buffer used to receive data. Advanced users may need to change this for performance tuning based on the size of the data. The default is 4kb.
+* `AllowedOrigins`    - List of the Origin header values allowed for WebSocket requests to prevent cross-site WebSocket hijacking. By default, all origins are allowed.


Suggested change

* `AllowedOrigins` - List of the Origin header values allowed for WebSocket requests to prevent cross-site WebSocket hijacking. By default, all origins are allowed.

* `AllowedOrigins` - List of the Origin header values allowed for WebSocket requests to prevent cross-site WebSocket hijacking. By default, all origins are allowed.

scottaddie · 2018-11-05T23:31:14Z

aspnetcore/signalr/security.md

@@ -39,6 +39,14 @@ For example, the following CORS policy allows a SignalR browser client hosted on

 ## WebSocket Origin Restriction

+::: moniker range=">= aspnetcore-2.2"
+
+The protections provided by CORS don't apply to WebSockets. For origin restriction on WebSockets read [WebSockets origin restriction](xref:fundamentals/websockets#websocket-origin-restriction).


Add a comma after "For origin restrictions on WebSockets".

analogrelay · 2018-11-06T17:52:53Z

aspnetcore/fundamentals/websockets.md

+```c#
+app.UseWebSockets(new WebSocketOptions()
+{
+    AllowedOrigins.Add("https://client.com");


Show multiple origins (like https://client.com and https://www.client.com) to illustrate that

aspnetcore/fundamentals/websockets.md

Co-Authored-By: BrennanConroy <brecon@microsoft.com>

aspnetcore/fundamentals/websockets.md

scottaddie · 2018-11-06T19:40:36Z

aspnetcore/fundamentals/websockets.md

+
+However, browsers do send the `Origin` header when issuing WebSocket requests. Applications should be configured to validate these headers to ensure that only WebSockets coming from the expected origins are allowed.
+
+If you are hosting your server on "https://server.com" and hosting your client on "https://client.com", add "https://client.com" to the `AllowedOrigins` list for WebSockets to verify.


you are --> you're

Co-Authored-By: BrennanConroy <brecon@microsoft.com>

scottaddie · 2018-11-06T21:56:00Z

Thank you for your help, @BrennanConroy!

BrennanConroy added 3 commits November 5, 2018 10:46

wip WebSocket Origin Restriction

a00c8b9

Fix monikers

05a31db

fix xref

68ec2c0

BrennanConroy commented Nov 5, 2018

View reviewed changes

BrennanConroy changed the title ~~wip WebSocket Origin Restriction~~ WebSocket Origin Restriction Nov 5, 2018

BrennanConroy requested review from tdykstra and analogrelay November 5, 2018 19:08

tdykstra approved these changes Nov 5, 2018

View reviewed changes

halter73 reviewed Nov 5, 2018

View reviewed changes

fb

764bcaa

halter73 reviewed Nov 5, 2018

View reviewed changes

halter73 approved these changes Nov 5, 2018

View reviewed changes

halter73 reviewed Nov 5, 2018

View reviewed changes

aspnetcore/fundamentals/websockets.md Outdated Show resolved Hide resolved

Update aspnetcore/fundamentals/websockets.md

5741728

Co-Authored-By: BrennanConroy <brecon@microsoft.com>

scottaddie reviewed Nov 5, 2018

View reviewed changes

fb

5d645e9

analogrelay approved these changes Nov 6, 2018

View reviewed changes

analogrelay and others added 2 commits November 6, 2018 11:28

Update aspnetcore/fundamentals/websockets.md

64c01db

Co-Authored-By: BrennanConroy <brecon@microsoft.com>

fb

c511371

scottaddie reviewed Nov 6, 2018

View reviewed changes

scottaddie and others added 3 commits November 6, 2018 13:22

Update aspnetcore/fundamentals/websockets.md

546e0cd

Co-Authored-By: BrennanConroy <brecon@microsoft.com>

fb

2297efe

Update ms.date value

ee39f7d

scottaddie approved these changes Nov 6, 2018

View reviewed changes

scottaddie merged commit d396dff into master Nov 6, 2018

delete-merged-branch bot deleted the brecon/websocketOrigin branch November 6, 2018 21:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WebSocket Origin Restriction #9447

WebSocket Origin Restriction #9447

BrennanConroy commented Nov 5, 2018 •

edited

Loading

BrennanConroy Nov 5, 2018

tdykstra Nov 5, 2018

tdykstra left a comment

tdykstra Nov 5, 2018

tdykstra Nov 5, 2018

tdykstra Nov 5, 2018

BrennanConroy Nov 5, 2018

analogrelay Nov 6, 2018

tdykstra Nov 5, 2018

tdykstra Nov 5, 2018

tdykstra Nov 5, 2018

BrennanConroy commented Nov 5, 2018

tdykstra commented Nov 5, 2018

halter73 Nov 5, 2018

halter73 Nov 5, 2018 •

edited

Loading

scottaddie Nov 5, 2018

scottaddie Nov 5, 2018

scottaddie Nov 5, 2018

scottaddie Nov 5, 2018

analogrelay Nov 6, 2018

scottaddie Nov 6, 2018

scottaddie commented Nov 6, 2018

	* `AllowedOrigins` - List of the Origin header values allowed for WebSocket requests to prevent cross-site WebSocket hijacking. By default, all origins are allowed.
	* `AllowedOrigins` - List of the Origin header values allowed for WebSocket requests to prevent cross-site WebSocket hijacking. By default, all origins are allowed.


		However, browsers do send the `Origin` header when issuing WebSocket requests. Applications should be configured to validate these headers to ensure that only WebSockets coming from the expected origins are allowed.

		If you are hosting your server on "https://server.com" and hosting your client on "https://client.com", add "https://client.com" to the `AllowedOrigins` list for WebSockets to verify.

WebSocket Origin Restriction #9447

WebSocket Origin Restriction #9447

Conversation

BrennanConroy commented Nov 5, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tdykstra left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

BrennanConroy commented Nov 5, 2018

tdykstra commented Nov 5, 2018

Choose a reason for hiding this comment

halter73 Nov 5, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

scottaddie commented Nov 6, 2018

BrennanConroy commented Nov 5, 2018 •

edited

Loading

halter73 Nov 5, 2018 •

edited

Loading