This repository has been archived by the owner on Jan 14, 2022. It is now read-only.
Improve security to match Node.js version #21
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously, the access token needed to be passed via the query string; with this commit, the token can be passed *either* through the query string or the Sec-WebSocket-Protocol header. This was done to correspond to the changes made to the streaming.js version in [Improve streaming server security](mastodon/mastodon#10818). However, I am not sure that it *does* increase security; as explained at <https://support.ably.io/support/solutions/articles/3000075120-is-it-secure-to-send-the-access-token-as-part-of-the-websocket-url-query-params->, there is generally no security advantage to passing sensitive information via websocket headers instead of the query string—the entire connection is encrypted and is not stored in the browser history, so the typical reasons to keep sensitive info out of the query string don't apply. I would welcome any corrections on this/reasons this change improves security.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR makes two changes to improve security/conform this codebase to the Node.js version it is replacing (and thus closes #20). Specifically, these changes implement the fixes added in mastodon/mastodon#10818
First, it checks OAuth scopes and ensures that the client is authorized to read the data it is requesting. This prevents apps that have write-only access (like a Twitter cross-posting bot) from reading user data via the streaming API.
Second, it adds the ability for WebSocket clients to pass the access token via the
sec-websocket-protocolheader rather than in the query string.