Subject: [openpgp] Web Key Directory and CORS

From: Wiktor Kwapisiewicz <[email-masked]>
Date: Mon, 25 Mar 2019 22:08:30 +0100

Hello,

I would like to ask if it would be possible to add a mention of CORS 
header [0] in 3.1. Key discovery [1] in OpenPGP Web Key Directory document.

I think it could be added somewhere below:

>    The server SHOULD use "application/octet-stream" as the Content-Type
>    for the data but clients SHOULD also accept any other Content-Type.
>    The server MUST NOT return an ASCII armored version of the key.

And the wording may be something like: "It is RECOMMENDED that the key 
is returned with 'Access-Control-Allow-Origin' HTTP header set to value 
'*'".

The context of this change is the following: without appropriate CORS 
header JavaScript code running on one domain cannot access resources 
hosted on different domains. There are web applications that would like 
to fetch the key and encrypt data purely in the browser and send only 
encrypted blobs to the backend thus minimizing attack surface somehow. [2]

OpenPGP.js today can do WKD lookups, but without CORS header set it 
cannot fetch keys from any domain [3] thus making WKD not usable in the 
browser [4].

One similar paragraph, recommending CORS header for 
"/.well-known/host-meta" can be found in XMPP [5].

Thank you for your time!

Kind regards,
Wiktor

[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

[1]: 
https://tools.ietf.org/html/draft-koch-openpgp-webkey-service-07#section-3.1

[2]: One such site is https://pipefile.com

[3]: This was pointed out by Sanjana Rajan:
https://github.com/openpgpjs/openpgpjs/pull/714#issuecomment-392609354

[4]: Thomas Oberndörfer mentions that "For regular web pages, CORS 
header would be beneficial":
https://github.com/mailvelope/mailvelope/issues/580#issuecomment-394690051

[5]: https://xmpp.org/extensions/xep-0156.html#impl

-- 
https://metacode.biz/@wiktor

---

From: Bart Butler <[email-masked]>
Date: Sat, 30 Mar 2019 17:09:35 +0000

I agree, it would be beneficial to have some CORS guidance in the spec in order to help implementors support browser-based lookups, and the proposed language sounds fine to me.

What do you think Werner?

-Bart

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

> -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
> 

> openpgp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/openpgp

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Sun, 31 Mar 2019 19:22:47 -0400

> is returned with 'Access-Control-Allow-Origin' HTTP header set to value 

I think this is potentially dangerous if it is done on the main domain
(e.g. at "example.net", instead of the "advanced" form at
"openpgpkey.example.net"), because the main domain for any given site
might have resources where this CORS header would be inappropriate.

Assuming that the "advanced" domain "openpgp.example.net" is used, and
the document tree published there is limited to WKD, then i agree that
such a CORS statement seems safe, though.

I don't know CORS well enough to know how to properly constrain such a
header, but if we do add guidance, i'd want to make sure it is narrowly
scoped so that an administrator deploying WKD doesn't accidentally open
up the rest of the site's data to external cross-origin requests.

   --dkg