Subject: [OAUTH-WG] purpose of client sending bodyhash in mac authorized requests

From: Doug Tangren <[email-masked]>
Date: Sun, 15 May 2011 22:31:20 -0400

I'm implementing a mac authorization module for request handling library [1]
based on the latest mac spec. I ran into a curious implementation detail
having do with the bodyhash value passed in by the client.

Here [2], it says the server should recalculate the bodyhash if the client
passes one in. Since it doesn't mention comparing bodyhash values, does that
mean the only reason for having to pass in the value of the bodyhash is so
that the server knows to include it's own bodyhashing vs an empty string in
the mac hash verification? Otherwise, I don't see why the client needs to
pass it in. There there an implicit requirent for the server to also
validate the bodyhash before calculating the it's own mac for validation?

I realize some request bodies may be empty but couldn't the server detect
that on it's own and make it required that the client also includes a
bodyhash in its own mac calculation. That would be one less header field
server implementors have to handle different paths of executions for.

[1]: https://github.com/n8han/unfiltered/#readme
[2]: http://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-05#section-4

-Doug Tangren
http://lessis.me

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 16 May 2011 01:06:56 -0700

The attributes serves both as a flag to indicate that a body hash has been included, but also to allow validation of the request (excluding the body) before the body is received.

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Doug Tangren
Sent: Sunday, May 15, 2011 7:31 PM
To: [email-masked]
Subject: [OAUTH-WG] purpose of client sending bodyhash in mac authorized requests

I'm implementing a mac authorization module for request handling library [1] based on the latest mac spec. I ran into a curious implementation detail having do with the bodyhash value passed in by the client.

Here [2], it says the server should recalculate the bodyhash if the client passes one in. Since it doesn't mention comparing bodyhash values, does that mean the only reason for having to pass in the value of the bodyhash is so that the server knows to include it's own bodyhashing vs an empty string in the mac hash verification? Otherwise, I don't see why the client needs to pass it in. There there an implicit requirent for the server to also validate the bodyhash before calculating the it's own mac for validation?

I realize some request bodies may be empty but couldn't the server detect that on it's own and make it required that the client also includes a bodyhash in its own mac calculation. That would be one less header field server implementors have to handle different paths of executions for.

-Doug Tangren
http://lessis.me

---

From: Doug Tangren <[email-masked]>
Date: Mon, 16 May 2011 09:42:21 -0400

-Doug Tangren
http://lessis.me

On Mon, May 16, 2011 at 4:06 AM, Eran Hammer-Lahav <[email-masked]>wrote:

> The attributes serves both as a flag to indicate that a body hash has been
> included, but also to allow validation of the request (excluding the body)
> before the body is received.
>
>
Makes sense. Thanks!