mirror of
https://github.com/discourse/discourse.git
synced 2025-06-01 04:13:53 +08:00
Revert "FEATURE: Protect against replay attacks when using TLS 1.3 0-RTT (#8020)"
This reverts commit 39c31a3d7693fae488461079c6f0c2bc7305c02e. Sorry about this, we have decided againse supporting 0-RTT directly in core, this can be supported with similar hacks to this commit in a plugin. That said, we recommend against using a 0-RTT proxy for the Discourse app due to inherit risk of replay attacks.
This commit is contained in:
@ -1,27 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
module Middleware
|
||||
class EarlyDataCheck
|
||||
def initialize(app, settings = nil)
|
||||
@app = app
|
||||
end
|
||||
|
||||
# When a new connection happens, and it uses TLS 1.3 0-RTT
|
||||
# the reverse proxy will set the header `Early-Data` to 1.
|
||||
# Due to 0-RTT susceptibility to Replay Attacks only GET
|
||||
# requests for anonymous users are allowed.
|
||||
# Reference: https://tools.ietf.org/html/rfc8446#appendix-E.5
|
||||
def call(env)
|
||||
if env['HTTP_EARLY_DATA'].to_s == '1' &&
|
||||
(env['REQUEST_METHOD'] != 'GET' || CurrentUser.has_auth_cookie?(env))
|
||||
[
|
||||
425,
|
||||
{ 'Content-Type' => 'text/html', 'Content-Length' => '9' },
|
||||
['Too Early']
|
||||
]
|
||||
else
|
||||
@app.call(env)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
Reference in New Issue
Block a user