Security: Sideband information cover traffic middleware

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
import random
from django.http import HttpResponse

class SidebandCoverTrafficMiddleware(object):
    """
    HTTP traffic (even under SSL) can be observed for information leakage based on 
    response lengths; this is more important with AJAX providing many small requests.
    
    See http://www.freedom-to-tinker.com/blog/felten/side-channel-leaks-web-applications
    
    A mitigation is to add some padding to responses to obscure the original lengths.
    """
    SUPPORTED_MIMETYPES = (
        'text/*',
    )
    SUPPORTED_STATUSES = (
        200,
    )
    EXTRA_PADDING_MAX = 1024

    def should_process(self, response):
        if not response.status_code in self.SUPPORTED_STATUSES:
            return False
        ct = response['content-type']
        ct_prefix = ct.split('/')[0] + '/*'
        if not (ct_prefix in self.SUPPORTED_MIMETYPES or 
                ct in self.SUPPORTED_MIMETYPES):
            return False
        return True

    def process_response(self, request, response):
        if self.should_process(response):
            return HttpResponse(response.content + ' ' * random.randint(0, self.EXTRA_PADDING_MAX), 
                    content_type=ct,
                    status=response.status_code
                    )

More like this

  1. SSL / HTTPS Middleware for Redirection and href Rewriting by DrMeers 3 years, 12 months ago
  2. SSL Middleware by sjzabel 7 years, 1 month ago
  3. Enable AWS ELB with SSL Termination by zvikico 2 years, 10 months ago
  4. SSL Redirect Middleware and testing by willhardy 5 years, 9 months ago
  5. Load static media from secure (SSL) static server (Context Processor) by ianreardon 4 years, 6 months ago

Comments

bandris (on March 25, 2010):

Why not end should_process simply by:

return ct_prefix in self.SUPPORTED_MIMETYPES or ct in self.SUPPORTED_MIMETYPES

#

(Forgotten your password?)