Detections
Analytics
1.56 Ensure 'Allow socket pool size randomization for proxies' is set to 'Enabled'
Information
This policy setting controls whether Microsoft Edge randomizes socket pool sizes for proxy connections. Socket pool size randomization is a security mechanism that prevents attackers from using deterministic connection limits to infer cross-site information.The recommended state for this setting is: Enabled.
Note: This policy affects the limits configured by the MaxConnectionsPerProxy and MaxConnectionsPerProxyForWebSocket policies. When enabled, the effective upper limit can be randomized up to 2x the values configured by those policies, though the expected increase is closer to 1.2x in practice.
Without socket pool size randomization, the deterministic connection limit for proxy connections becomes a side channel that attackers can exploit to infer cross-site information. By observing when the browser stops opening new connections, an attacker can deduce the number of active connections to other sites through the same proxy, revealing browsing behavior across origins.
Solution
To establish the recommended configuration via GP, set the following UI path to Enabled :Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Allow socket pool size randomization for proxies
Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft.
Impact:
Proxy connections may use up to twice the number of connections specified by MaxConnectionsPerProxy and MaxConnectionsPerProxyForWebSocket . The effective connection ceiling is non-deterministic, which may complicate proxy capacity planning for environments with strict connection limits.
See Also
Item Details
Audit Name: CIS Microsoft Edge v5.0.0 L1
Category: SYSTEM AND INFORMATION INTEGRITY
References: 800-53|SI-16
Plugin: Windows
Control ID: c4223a975ec2b437c7c2a7f1539a3ab1d6fe3d4dc2cc7f7c8a461e0d4c989408