0

Introduction to the problem

Recently I was working on some request signing algorithm and it came out the opinions about including query string in the part that is then signed are "diversified".

Long story short, the argument of the person against including query string in the string for signing is that the query strings can be altered (eg. values can be changed, arguments can be removed/added, order can be changed).

Also I have never ever experienced such behaviour in proxy or load balancer, even though I experienced such things as hiding Authorization header (eg. by Apache/WSGI), altering method of the request (by load balancer, probably Amazon's servers do such thing). I know such behaviour can be enabled on reverse proxy or load balancer, using some custom scripts / rules, but it could be done with any part of the request.

A lot of work has been done based on the assumption query string should be included, plus it looks silly to not sign one of the most important parts of the request. Thus I need to know if including query string in the raw form (as it is passed within the URL) will be an issue in the future or not.

Actual question

So my question is:

Is it common for any proxy or load balancer to alter query strings? It seems silly for me. Do you know any proxy or load balancer (software or its installation) that does that by default?

I am sure in such case we can handle signature verification on the level of proxy/load balancer, but it may be a viable argument if this is common among the intermediaries we do not control.

Please, let me know what you know about it. Let me know, if you have any questions.

As a clarification, by query string I mean the "?arg1=val1&arg2=val2" part of the following URL:

http://example.com/something/else?arg1=val1&arg2=val2

And by "altering the query string" I mean any action that could make it look different for the client and for the server (server sees query string different than the client has used).

2 Answers 2

1

Many modern reverse-proxies could alter the query-strings. But i see no reason why a load-balancer or proxy will do that by default.

Maybe it uses the URI for sticky session load-balancing, but that would be really stupid.

So: No, i don't know any load-balancer, altering the uri and the parameters by default.

1
  • Thanks, this really baffled me. When it comes to sessions, the API is stateless, so no support for sessions is planned (every request is separate from the other), so I am not worried about that, but thank you for mentioning this. I would be happy to hear also the opinions of others (if there is anyone else having something to say in this matter).
    – Tadeck
    Oct 16, 2012 at 8:15
1

I have yet to see a proxy that does it but it can be a viable solution for session stickiness if you can't do it per IP and you want it to work even if user has cookies disabled.

2
  • Ok, so I suspect it won't happen in a proxy you will be using to connect to the Internet, but on a reverse proxy (the one used by people to access your server) probably, right? I am thinking about the case of RESTful, stateless API, where sessions are not supported by the client, nor by the server.
    – Tadeck
    Oct 16, 2012 at 9:10
  • exactly, but then again, never underestimate human stupidity ;) Oct 17, 2012 at 10:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .