Page 1 of 1
Doc for use of SELF token in ABE
Posted: Wed Jul 01, 2009 5:02 pm
by diablodale
Hello. I read the 0.5 abe rules spec, searched for "abe self" here and the two pages linked from noscript. Still looking for this answer.
What is the behavior of SELF? I see it used in two ways and wonder if I third exists?
1. What does it mean to put SELF before a resource versus SELF alone? For example:
Code: Select all
Site *.somesite.com
Accept POST SUBDOC from SELF https://secure.somesite.com
** or **
Site www.somesite.com/logout
Accept GET POST from SELF
2. Can I write the following and it mean 'allows all behavior from *.eye.fi to my local computer'
Code: Select all
Site SELF
Accept ALL from *.eye.fi
Re: Doc for use of SELF token in ABE
Posted: Wed Jul 01, 2009 6:00 pm
by Giorgio Maone
SELF designates "the same sites as the destination", and it makes sense only in a from clause.
For instance,
Code: Select all
Site https://mail.myorganization.com https://private.myorganization.com
Accept from SELF
Deny
means that my mail server and my "private" server will accept requests from themselves only (i.e. will not allow other sites to link them for CSRF).
Code: Select all
Site *.somesite.com
Accept POST SUB from SELF https://secure.somesite.com
Deny
means that every subdomain of somesite.com (*.somesite.com) accept POST and framed request from themselves and
https://secure.somesite.com, i.e.
http://www.somesite.com >>>
http://www.somesite.com is OK,
https://secure.somesite.com >>>
http://www.somesite.com is OK, but
http://mail.somesite.com >>>
http://www.somesite.com will fail just like
http://evil.com >>>
http://www.somesite.com.
Code: Select all
Can I write the following and it mean 'allows all behavior from *.eye.fi to my local computer
Your local computer and LAN is conveniently represented by the LOCAL placeholder.
However if you've got no web application running there it doesn't make much sense:
means that web applications running inside your LAN (including your own computer) will accept all kind of HTTP requests originated from *.eye.fi web pages.
Re: Doc for use of SELF token in ABE
Posted: Wed Jul 01, 2009 6:37 pm
by diablodale
Thank you. That all makes sense and is clear.