[Security] Require IPFS Gateways with Origin isolation

[lidel]

When a public IPFS gateway is used in a browser context, it should ALWAYS provide origin isolation.

Brave allows user to customize public gateway address via settings:

We need to add validation when user submits alternative URL of the gateway:

Brave must validate it is safe for use in browsers and correctly resolves CIDs:

• Make HTTP request to {protocol}://{URL.host}/ipfs/bafkqae2xmvwgg33nmuqhi3zajfiemuzahiwss
  • Confirm that user is redirected and ends up on {protocol}://bafkqae2xmvwgg33nmuqhi3zajfiemuzahiwss.ipfs.{URL.host}
  • Confirm the above subdomain returned Welcome to IPFS :-)

cc @diracdeltas @bbondy @spylogsster – I feel this is pretty important to add, protects BRave and IPFS from bad security+PR incidents due to people using insecure gateways.

Test cases

• allow only gateways that provide subdomain isolation. For example:
  • http://localhost:{any port}/ is a subdomain gateway from a local IPFS node
  • https://dweb.link/ is a subdomain gateway from Protocol Labs
  • https://cf-ipfs.com/ is a subdomain gateway from Cloudflare
• refuse to use gateways that share origin across all CIDs. For example:
  • http://127.0.0.1:{any port}/ is a path gateway from a local IPFS node (no origin isolation)
  • https://ipfs.io is a legacy path gateway from Protocol Labs
  • https://cloudflare-ipfs.com is a legacy path gateway from Cloudflare

[stephendonner]

Verified PASSED using

Brave	1.30.42 Chromium: 93.0.4577.51 (Official Build) nightly (x86_64)
Revision	762d21050e2da59930c784c09b134d0b0b148188-refs/branch-heads/4577@{#915}
OS	macOS Version 11.5.2 (Build 20G95)

Steps:

1. new profile
2. launched Brave
3. opened brave://settings/ipfs
4. input the following expected allowed values and confirmed they were accepted
   • https://localhost:48081
   • https://dweb.link/
   • https://cf-ipfs.com/ - filed Unable to input/use https://cf-ipfs.com subdomain gateway #17648
5. input the following disallowed values and confirmed they were rejected
   • http://127.0.0.1:48081
   • https://ipfs.io
   • https://cloudflare-ipfs.com

Allowed values

https://localhost:48081	https://dweb.link/	https://cf-ipfs.com/
		N/A; see #17648

Disallowed values

http://127.0.0.1:48081	https://ipfs.io	https://cloudflare-ipfs.com

---

Verified PASSED using

Brave	1.30.66 Chromium: 93.0.4577.63 (Official Build) dev (64-bit)
Revision	ff5c0da2ec0adeaed5550e6c7e98417dac77d98a-refs/branch-heads/4577@{#1135}
OS	Linux

Steps:

1. new profile
2. launched Brave
3. opened brave://settings/ipfs
4. input the following expected allowed values and confirmed they were accepted
   • http://localhost:48082
   • https://dweb.link/
   • https://cf-ipfs.com/ - filed Unable to input/use https://cf-ipfs.com subdomain gateway #17648
5. input the following disallowed values and confirmed they were rejected
   • http://127.0.0.1:48081
   • https://ipfs.io
   • https://cloudflare-ipfs.com

Allowed values

http://localhost:48082	https://dweb.link/	https://cf-ipfs.com/
		N/A; see #17648

Disallowed values

http://127.0.0.1:48082	https://ipfs.io	https://cloudflare-ipfs.com

---

Verification passed on

Brave | 1.30.68 Chromium: 93.0.4577.63 (Official Build) beta (64-bit)
-- | --
Revision | ff5c0da2ec0adeaed5550e6c7e98417dac77d98a-refs/branch-heads/4577@{#1135}
OS | Windows 10 OS Version 2009 (Build 19043.1165)

Steps:

1. new profile
2. launched Brave
3. opened brave://settings/ipfs
4. input the following expected allowed values and confirmed they were accepted
   • https://localhost:48081 - Logged Invalid gateway address message is shown when https://localhost:{any port} is set in IPFS gateway #17966
   • https://dweb.link/
   • https://cf-ipfs.com/ - Encountered Unable to input/use https://cf-ipfs.com subdomain gateway #17648
5. input the following disallowed values and confirmed they were rejected
   • http://127.0.0.1:48081
   • https://ipfs.io
   • https://cloudflare-ipfs.com

Allowed values

http://localhost:48083	https://dweb.link/	https://cf-ipfs.com/

Disallowed values

http://127.0.0.1:48083	https://ipfs.io	https://cloudflare-ipfs.com

[srirambv]

Removing Android label from this one as Android only uses public gateway as of now. Can create a new issue when Android supports custom gateways

[markg85]

Not sure if this issue should be reopened or if i should report a new one.

I'm in the position where i want to run a local IPFS node in my local network but not on my local machine. The reason here is multiple pc's in the same network and i want them all to use the same single IPFS node in the network.
So say:
127.0.0.1 = local machine (10.0.0.1)
10.0.0.2 = local network machine running IPFS

Currently brave forbids setting my local network machine as gateway.
Brave also forbids me to use "127.0.0.1" whereas "localhost" does work. These checks are too strict imho.

In my case i can easily work around it by just making an ssh tunnel: ssh -L 8080:127.0.0.1:8080 user@<network node> which makes both localhost:8080 and 127.0.0.1:8080 work just fine and thereby satisfying the brave requirements.

But is this really necessary? Do i really have to go through these hoops to get a local node working where for example dweb.link just works?

[lidel]

Yes, this is necessary.

What you are describing is not limitation of IPFS or Brave, but the basic security limitation of the web platform. Origin isolation is required in Brave, so you need to use localhost subdomain gateway.

localhost works without TLS because it is explicitly marked as Secure context:
https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts

Running plaintext Gateway in your LAN means it will have non-localhost address, so you need to set up self-signed TLS to ensure your browsing history can't be monitored or spoofed by malicious device in your LAN.

If you have https://gw.local then it should pass the test and will work fine.

[friedemannf]

Depending on the gateway implementation this check seems a bit too strict:

We have set up our IPFS gateway using a subdomain ipfs.example.com as other applications are hosted on the same domain. In this case this means that https://ipfs.example.com/ipfs/{cid} will be redirected to https://{cid}.ipfs.example.com but Brave expects a redirect to https://{cid}.ipfs.ipfs.example.com.

afaict this isn't in violation of the Subdomain Gateway Specification and should therefore be allowed. Please correct me if otherwise.

[MysticRyuujin]

I have the same problem as @friedemannf - If I put https://ipfs.my.network I get the Origin Isolation error and I can see the request come in as ipfs.ipfs.my.network