CORS Preflight Timing Attacks: A Security Guide

TL;DR

Yes, timing attacks against your server during CORS preflight requests are a legitimate concern. While less common than other web vulnerabilities, they can reveal sensitive information about your application’s internal logic and potentially allow attackers to bypass security measures. This guide explains how these attacks work and provides practical steps to mitigate them.

What are Timing-Based Side-Channel Attacks?

Timing attacks don’t exploit bugs in your code directly. Instead, they measure the time it takes for your server to respond to different requests. Small differences in response time can indicate whether a particular check or operation is being performed – even if the attacker doesn’t know what that operation is.

How CORS Preflight Requests are Vulnerable

CORS (Cross-Origin Resource Sharing) preflight requests (OPTIONS requests) are used to determine if an actual cross-origin request is safe. Your server needs to check things like allowed methods, headers, and origins. These checks can take slightly different amounts of time depending on the outcome.

Steps to Mitigate Timing Attacks During CORS Preflight

1. Consistent Response Times: The most important step is to make sure your server takes roughly the same amount of time to respond regardless of whether a preflight request passes or fails. Avoid conditional logic that significantly alters execution time based on the results of security checks.
   • Fixed-Time Comparisons: Use fixed-time string comparison functions when validating headers and origins. Standard string comparisons can be vulnerable because they stop as soon as a mismatch is found, leading to timing differences.
2. Avoid Early Exits: Don’t return early from your preflight handling code based on the results of checks. Process all checks before sending a response.

   // Bad - potential timing leak
   if (!allowedOrigin(request.origin)) {
     return errorResponse(); // Returns immediately if origin is not allowed
   }
   // ... other checks...
   

   // Good - consistent processing
   if (allowedOrigin(request.origin) == false) {
     // Log the failed check, but continue processing.
   }
   // ... other checks...
   return response(); // Return after all checks are complete
   

3. Rate Limiting: Implement rate limiting on preflight requests to make it harder for attackers to gather enough timing data. This won’t prevent the attack entirely, but it will slow it down significantly.
   • Consider using a web application firewall (WAF) or your server’s built-in rate limiting features.
4. Noise Introduction: Add a small amount of random delay to all preflight responses. This makes it harder for attackers to accurately measure timing differences.

   // Example (Python)
   import time, random
   
   def handle_preflight(request):
       # ... security checks...
       time.sleep(random.uniform(0.01, 0.03)) # Add a 1-3ms delay
       return response()
   

   Be careful with this approach; excessive delays can impact performance.

5. Regular Security Audits: Conduct regular security audits and penetration testing to identify potential timing vulnerabilities. Automated tools can help, but manual review is also important.
   • Focus on code that handles sensitive data or performs critical security checks.
6. Keep Software Updated: Ensure your web server, framework, and any related libraries are up to date with the latest security patches. Vulnerabilities in these components can sometimes be exploited through timing attacks.

Important Considerations

• Complexity: Mitigating timing attacks can be complex and require careful code review.
• Performance Impact: Some mitigation techniques (like noise introduction) can have a slight impact on performance.
• False Positives: Be aware that network latency and other factors can also affect response times, so it’s important to distinguish between legitimate timing differences and potential attack signals.