{"action":"closed","issue":{"url":"https://api.github.com/repos/httpwg/http-extensions/issues/73","labels_url":"https://api.github.com/repos/httpwg/http-extensions/issues/73/labels{/name}","comments_url":"https://api.github.com/repos/httpwg/http-extensions/issues/73/comments","events_url":"https://api.github.com/repos/httpwg/http-extensions/issues/73/events","html_url":"https://github.com/httpwg/http-extensions/issues/73","id":82172416,"number":73,"title":"Alt-Svc:  Elevation of privilege","user":{"login":"MikeBishop","id":4273797,"avatar_url":"https://avatars.githubusercontent.com/u/4273797?v=3","gravatar_id":"","url":"https://api.github.com/users/MikeBishop","html_url":"https://github.com/MikeBishop","followers_url":"https://api.github.com/users/MikeBishop/followers","following_url":"https://api.github.com/users/MikeBishop/following{/other_user}","gists_url":"https://api.github.com/users/MikeBishop/gists{/gist_id}","starred_url":"https://api.github.com/users/MikeBishop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MikeBishop/subscriptions","organizations_url":"https://api.github.com/users/MikeBishop/orgs","repos_url":"https://api.github.com/users/MikeBishop/repos","events_url":"https://api.github.com/users/MikeBishop/events{/privacy}","received_events_url":"https://api.github.com/users/MikeBishop/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/httpwg/http-extensions/labels/alt-svc","name":"alt-svc","color":"fbca04"},{"url":"https://api.github.com/repos/httpwg/http-extensions/labels/design","name":"design","color":"02d7e1"},{"url":"https://api.github.com/repos/httpwg/http-extensions/labels/editor-ready","name":"editor-ready","color":"0b02e1"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-28T23:37:28Z","updated_at":"2015-10-06T19:37:13Z","closed_at":"2015-10-06T19:37:13Z","body":"Someone who controls any resource on an origin can issue directives that affect all resources on that origin.  (Thinking of the server the CS/CE students could work with in college, where we all had pages at server.example.edu/~username.)  Sure, I can’t change the host because I don’t have the server cert, but I can change ports without that requirement.\r\n\r\nThe guidance in 9.1 just says “don’t let people do that,” which is easier said than done on systems that already exist.  People can run apps listening on ephemeral ports, and people can control their home pages.  With this combination, everyone else's home pages can be hijacked unless the server admin reads this draft before any students do and promptly prohibits pages from emitting headers named Alt-Svc.\r\n\r\nThe way to partially fix this is to require strong auth for changes of port as well.  Resources can still slow down access by causing attempts to access an alternate, but the alternate won't be able to supply fake resources."}}