Return HTTP Vary header

@Dolph: trying to assess impact. Could you explain how this could be abused ? If this is serious, we might want to coordinate disclosure rather than just push the fix.

This came out of a meeting with Jorge Williams yesterday. My understanding is that keystone can't be deployed behind an HTTP cache as-is. If you did, you would might see the following behavior.

---

Request from Client 1:

    GET /tenants
    X-Auth-Token: 12345

HTTP Cache: no existing cache; reverse proxies request

Keystone Response:

    { /* tenants specific to token 12345 */ }

HTTP Cache: caches response

Client 1 receives the appropriate tenant list.

---

Request from Client 2:

    GET /tenants
    X-Auth-Token: 67890

HTTP Cache: Existing cache found for GET /tenants

HTTP Cache Response:

    { /* tenants specific to token 12345 */ }

Client 2 receives tenant list for Client 1.

---

Appending a Vary header to the Keystone response would instruct the cache to differentiate between responses relevant to different tokens (i.e. vary the cache response based on the X-Auth-Token header). The same solution would also apply to the new X-Subject-Token header.

Hrm... Are such components supposed to be deployed behind a cache ? Looks like all requests should be unique and non-cached, so why would you deploy behind a cache ? Doesn't this also apply to Nova; Swift or Glance ? Adding Vish for more input.

I don't think this is a security vulnerability and it doesn't need to be private. No one has keystone deployed behind a cache at the moment. Seems like a useful thing to fix, however.

@Dolph: do you agree to open this up ? I wouldn't consider it an exploitable vulnerability, more a workaround for crazy people deploying auth systems behind caches ?

I'm not opposed to opening it up.

As is, you can't deploy behind a cache at all, anyway.

Fix proposed to branch: master
Review: https://review.openstack.org/3231

Reviewed: https://review.openstack.org/3231
Committed: http://github.com/openstack/keystone/commit/f2726df39c3ec4e50448361e3be4cfba45e4fa93
Submitter: Jenkins
Branch: master

commit f2726df39c3ec4e50448361e3be4cfba45e4fa93
Author: Dolph Mathews <email address hidden>
Date: Fri Jan 20 14:22:20 2012 -0600

    Added Vary header to support caching (bug 913895)

    Change-Id: I26dca09ace688a25cf207214808e8a9c919621c4