Just wondering if SNI is useful in segregating public content from private content. I managed to configure our server to serve
/foo for every client but serve
/bar only for clients from the intranet, by specifying the host name that is resolved only from intranet.
So the config goes like: (stripped to very essential part)
NameVirtualHost *:443 # JkWorkersFile must be global so including it here JkWorkersFile workers.properties <VirtualHost *:443> ServerName public.foo.com JkMountFile uriworkermap-pub.properties </VirtualHost> <VirtualHost *:443> ServerName private-foo JkMountFile uriworkermap-priv.properties </VirtualHost> <VirtualHost *:443> ServerName 10.1.2.3 JkMountFile uriworkermap-priv.properties </VirtualHost>
The catch is, if you add that name into your
hosts file to resolve to the public IP then SNI will actually resolve handle it the same way as if it were a valid request from the intranet.
I played around the thoughts of using only numeric IP instead of names (e.g.
10.1.2.3) but I presume the same can be tricked if the client has the same IP in their own subnet (e.g. a Linux host that forwards ports to the public IP of my web server.
The node sits behind a firewall on which I don't have influence. It has only one IP (the internal one) but if needed I can probably make it two.
Practical question is: how do you prevent such a leak? By means of htaccess for example? By specifying different IP addresses? Or is there no other way than creating a separate server instance and forgetting SNI?