#forwarded — Public Fediverse posts

It's disheartening that 25 years after the Web Standards Project (WaSP) was established, and 10 years after it was shut down with @Aaron's famous "Our work here is done” post, standards still have to be fought for with violence in order to be adopted.

https://www.webstandards.org/2013/03/01/our-work-here-is-done/index.html

#Microsoft #Azure #HTTP #Forwarded #Header #Standard #Standards #Standardization #Standardisation #RFC #IETF

It's disheartening that 25 years after the Web Standards Project (WaSP) was established, and 10 years after it was shut down with @Aaron's famous "Our work here is done” post, standards still have to be fought for with violence in order to be adopted.

https://www.webstandards.org/2013/03/01/our-work-here-is-done/index.html

#Microsoft #Azure #HTTP #Forwarded #Header #Standard #Standards #Standardization #Standardisation #RFC #IETF

Nothing being properly specified, the cardinality of the different `X-Forwarded-*` headers when used in combination, is also entirely undefined. Which values go with which when several `X-Forwarded-Host` and `X-Forwarded-Proto` are specified, for instance? How do you pair them up? Who knows! 🤷🏽‍♂️

However, the most important problem is that these headers impose a large security and privacy risk. Not having a common, evolving specification in which these security and privacy risks are discussed, and mitigated, is a major threat to the security of server infrastructure and the privacy of the users of that infrastructure.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#security_and_privacy_concerns

#Microsoft #Azure #HTTP #Forwarded #Header #Standard #Standards #Standardization #Standardisation #RFC #IETF

Nothing being properly specified, the cardinality of the different `X-Forwarded-*` headers when used in combination, is also entirely undefined. Which values go with which when several `X-Forwarded-Host` and `X-Forwarded-Proto` are specified, for instance? How do you pair them up? Who knows! 🤷🏽‍♂️

However, the most important problem is that these headers impose a large security and privacy risk. Not having a common, evolving specification in which these security and privacy risks are discussed, and mitigated, is a major threat to the security of server infrastructure and the privacy of the users of that infrastructure.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#security_and_privacy_concerns

#Microsoft #Azure #HTTP #Forwarded #Header #Standard #Standards #Standardization #Standardisation #RFC #IETF

It’s sad to see Microsoft Azure reenforcing the entrenchment of the non-standard, unspecified, buggy and insecure `X-Forwarded-*` headers:

https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions?tabs=azurecli#filter-by-http-header

…instead of the standard `Forwarded` header specified in RFC 7239:

https://www.rfc-editor.org/rfc/rfc7239.html

What's the problem with the `X-Forwarded-*` headers, you may ask? Well, for starters, there isn’t a specification in existence that tells implementers what to expect of their contents.

There's sort of a least common multiple of allowed values adhering to a sort of familiar HTTP header syntax, but no specification laying out "this is supported, period" exists. This is an interoperability nightmare in itself. Should the headers support one or multiple values? Who knows! 🤷🏽‍♂️

#Microsoft #Azure #HTTP #Forwarded #Header #Standard #Standards #Standardization #Standardisation #RFC #IETF

It’s sad to see Microsoft Azure reenforcing the entrenchment of the non-standard, unspecified, buggy and insecure `X-Forwarded-*` headers:

https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions?tabs=azurecli#filter-by-http-header

…instead of the standard `Forwarded` header specified in RFC 7239:

https://www.rfc-editor.org/rfc/rfc7239.html

What's the problem with the `X-Forwarded-*` headers, you may ask? Well, for starters, there isn’t a specification in existence that tells implementers what to expect of their contents.

There's sort of a least common multiple of allowed values adhering to a sort of familiar HTTP header syntax, but no specification laying out "this is supported, period" exists. This is an interoperability nightmare in itself. Should the headers support one or multiple values? Who knows! 🤷🏽‍♂️

#Microsoft #Azure #HTTP #Forwarded #Header #Standard #Standards #Standardization #Standardisation #RFC #IETF

Are you annoyed by my #forwarded #retweets from #birdside #twitter? Mastodon offers filters:
"Gear-icon > Filters"

Just put one in place, filtering "RT: @" and you'll never see rt-crossposts from me again!

#servicetoot