1038424 - loop client should explicitly validate that endpoints are using HTTPS

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Loop, defect)

Description

[Frederik Braun [:freddy]]

The loop client should ensure that endpoints are HTTPS (WSS) and refuse to talk in clear text.

e.g., http://loop.dev.mozaws.net and ws://loop.dev.mozaws.net/websocket should use https and wss instead

Comment 1

[Al Billings [:abillings - ex-MoCo]]

Is this issue Gaia only or will it affect Desktop Firefox?

Comment 2

[Frederik Braun [:freddy]]

This was filed while looking at the Gaia source code. I did not test the Desktop code.
Loading our Domains into the HTTPS Strict Transport Security (HSTS) preload list would solve both, though.

Comment 3

[Carmen Jimenez Cabezas]

Are the domains going to be included on the HSTS preload list finally? And if so do you want me to also add explicit protocol validation to the Firefox OS loop client?

Comment 4

[Frederik Braun [:freddy]]

I would argue for protocol validation on the firefox OS loop client, because pinning isn't consistent across all b2g versions.

The loop endpoint is under services.mozilla.com and thus covered by bug 1030135.
(The desktop version talks to call.mozilla.com, for which I filed bug 1074091).

Comment 5

[Carmen Jimenez Cabezas]

Attachment: V1 Proposed patch

Comment 6

[Frederik Braun [:freddy]]

Thanks for the quick turnaround.
f+ from my side, but take a look at the comments on Github.

Comment 7

[Carmen Jimenez Cabezas]

Frederik, I tried using the URL parser instead of using regular expressions but ran into a problem. When the URL is of the type:

url = "protocol://a.host.domain"

then 

new URL(url).href 

is 

"protocol://a.host.domain/" (note the extra / at the end). And with that /, the BrowserId assertions/logging on the Loop servers fails (it gives a 302). And since the / isn't added always, I cannot just remove it blindly (I would have to check if the original URL had a / before parsing it)... at the end it's just easier and faster using the regexp :).

Comment 8

[Frederik Braun [:freddy]]

Ah, that's unfortunate. Let's continue with the regexp then.

Comment 9

[Fernando Jiménez Moreno [:ferjm]]

Comment on attachment 8497762 [details] [review]
V1 Proposed patch

Thanks Carmen! I left one comment on the PR.

Comment 10

[Carmen Jimenez Cabezas]

https://github.com/mozilla-b2g/firefoxos-loop-client/commit/0bfa6ca9cca27d052a7b06b805a6674ded0bd882