opened 05:37PM - 09 Nov 23 UTC
Some Fastly users got an email saying that Fastly intends to stop allowing domai…n fronting on 2023-02-27.
<blockquote>
Fastly is committed to improving the security of our platform for all our users. One area we are working on is in enforcing the association between a TLS certificate's SAN entries and the hostname in the HTTP request's host header.
We will be forbidding domain fronting from happening by restricting it on a shared offset you might depend upon. This change will be applied during February 27th, 2024 .
Here are a few things to highlight based on our previous conversations with customers:
<dl>
<dt>Why block Domain Fronting now?</dt>
<dd><p>We want to block external malicious actors from utilizing domain fronting for our customers.</p></dd>
<dt>Does Domain Fronting cause immediate impact?</dt>
<dd><p>Existing domain fronting requests will be allowed. Any new domain fronting requests would be blocked. The exception for the existing domain fronting requests would be in place until the cert used for the request(s) expires or is replaced.</p></dd>
<dt>What does this mean?</dt>
<dd><p>The earliest cert expiration is shown in the "fastlycertificatedetail" column in the domain fronting report. This means that even if we block domain fronting today, you will have until the cert expires before impacts to domains will be seen. However, new domain fronting requests would be blocked.</p></dd>
<dt>What does the report show?</dt>
<dd><p>The purpose of the report is to provide visibility to you regarding external requests that are currently defined as domain fronting. These requests may be external requests that have explicit purpose to perform domain fronting and some requests may be requests that you currently use for the operations of your application.</p><p>Excluded from this report are services that are service chained or use shielding which will continue to work.</p></dd>
<dt>What is Fastly's ask?</dt>
<dd><p>Review the report and take action accordingly.</p><p>Actions may include but not limited to:</p>
<ul>
<li><b>Do nothing</b> and allow new requests to be blocked after the certificate expires.</li>
<li><b>Change Code</b> to provide the necessary SNI and hostname in TLS requests. This needs to be completed before the certificate expires.</li>
<li><b>Update Fastly TLS settings</b> to ensure that your service domains have a corresponding Fastly TLS domains.</li>
</ul></dd>
</dl>
</blockquote>
https://lists.torproject.org/pipermail/anti-censorship-team/2023-October/000328.html
Previously: #67