outline-apps icon indicating copy to clipboard operation
outline-apps copied to clipboard

Add Outline version to http fetch header for dynamic links

Open cornzzy opened this issue 7 months ago • 5 comments

Is there an existing issue that is already proposing this?

  • [X] I have searched the existing issues

Application

Outline Client

What are you trying to do? What is your use case?

Dynamic link web service needs to know Outline version to decide to return credentials or not.

Is your feature request related to a problem? Please describe it.

A single client can bring the whole server down for everyone by connecting from an older version.

But that's only for clients without any harmful intentions. There is another security issue, a client with harmful intentions can open dynamic link in browser, decode shadowsocks password, then use it as `ss://` without prefix and take the whole server down for everyone. This proposal is a **very soft fix** for this issue too. I couldn't think of a confident header value for a better fortification.

image

Describe the solution you'd like.

https://github.com/Jigsaw-Code/outline-apps/blob/dff8f19bde8864646e317e2875ab27842570b193/client/src/www/app/outline_server_repository/access_key_serialization.ts#L74

image

Describe alternatives you've considered

Given the current conditions, there is no way to circumvent this issue. I hope it's clear how high a priority this matter is and the significant impact it has on Outline's geographic targets.

cornzzy avatar Jul 24 '24 04:07 cornzzy