outline-apps
outline-apps copied to clipboard
Add Outline version to http fetch header for dynamic links
Is there an existing issue that is already proposing this?
- [X] I have searched the existing issues
Application
Outline Client
What are you trying to do? What is your use case?
Dynamic link web service needs to know Outline version to decide to return credentials or not.
Is your feature request related to a problem? Please describe it.
A single client can bring the whole server down for everyone by connecting from an older version.
But that's only for clients without any harmful intentions. There is another security issue, a client with harmful intentions can open dynamic link in browser, decode shadowsocks password, then use it as `ss://` without prefix and take the whole server down for everyone. This proposal is a **very soft fix** for this issue too. I couldn't think of a confident header value for a better fortification.
Describe the solution you'd like.
https://github.com/Jigsaw-Code/outline-apps/blob/dff8f19bde8864646e317e2875ab27842570b193/client/src/www/app/outline_server_repository/access_key_serialization.ts#L74
Describe alternatives you've considered
Given the current conditions, there is no way to circumvent this issue. I hope it's clear how high a priority this matter is and the significant impact it has on Outline's geographic targets.