Subject: Re: [OAUTH-WG] security considerations - authorization tokens

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 7 Jul 2011 08:18:26 -0700

Looking back at the archives, I didn't find any replies to this proposal.

Torsten / Mark / Phil - is this a change you would like me to make?

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Brian Eaton
> Sent: Sunday, May 22, 2011 8:47 PM
> To: [email-masked]
> Subject: [OAUTH-WG] security considerations - authorization tokens
> 
> As I said in the other note, after reading through the security considerations
> section a couple of times, I think it could benefit from a different
> organization.  Specifically
> 
> - keep the introduction, it's awesome.
> - write new sections for each of the following
>    1) Authorization Tokens
>    2) Web Application Clients
>    3) User-Agent Clients
>    4) Installed Application Clients
>    5) Authorization Servers
>    6) Resource Servers
> - merge the current text into the appropriate sections.
> 
> I took a swing at the authorization tokens text.  I tried to capture most of the
> relevant items from the current draft, but might have missed some.
> 
> Cheers,
> Brian

---

From: Anthony Nadalin <[email-masked]>
Date: Thu, 7 Jul 2011 17:49:54 +0000

When we constructed the current structure in Prague we thought that structure best fit the needs of a implementer, so my preference would be to keep it as it is now but, Torsten / Mark / Phil also may have feedback.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Eran Hammer-Lahav
Sent: Thursday, July 07, 2011 8:18 AM
To: [email-masked]; 'Mark Mcgloin ([email-masked])'; 'Torsten Lodderstedt ([email-masked])'; 'Phil Hunt ([email-masked])'
Subject: Re: [OAUTH-WG] security considerations - authorization tokens

EHL

> As I said in the other note, after reading through the security 
> considerations section a couple of times, I think it could benefit 
> from a different organization.  Specifically
> 
> I took a swing at the authorization tokens text.  I tried to capture 
> most of the relevant items from the current draft, but might have missed some.
> 
> Cheers,
> Brian
_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Brian Eaton <[email-masked]>
Date: Thu, 7 Jul 2011 10:58:51 -0700

On Thu, Jul 7, 2011 at 10:49 AM, Anthony Nadalin <[email-masked]>wrote:

> When we constructed the current structure in Prague we thought that
> structure best fit the needs of a implementer, so my preference would be to
> keep it as it is now but, Torsten / Mark / Phil also may have feedback.
>

Really?

The current doc has *no guidelines* on how to implement authorization tokens
whatsoever.

So even if you like the current organization of the security considerations,
I suspect you'll agree it would make sense to offer some guidance on how
these tokens ought to be implemented.

---

From: Anthony Nadalin <[email-masked]>
Date: Thu, 7 Jul 2011 18:08:01 +0000

I was responding to the structure question only. The token text is questionable sine the tokens are opaque to the core, seems like the token write-up better belongs in the threat model document. Developers of the various token specs and use this as guidance and reference it.

From: Brian Eaton [mailto:[email-masked]]
Sent: Thursday, July 07, 2011 10:59 AM
To: Anthony Nadalin
Cc: Eran Hammer-Lahav; [email-masked]; Mark Mcgloin ([email-masked]); Torsten Lodderstedt ([email-masked]); Phil Hunt ([email-masked])
Subject: Re: [OAUTH-WG] security considerations - authorization tokens

On Thu, Jul 7, 2011 at 10:49 AM, Anthony Nadalin <[email-masked]<mailto:[email-masked]>> wrote:
When we constructed the current structure in Prague we thought that structure best fit the needs of a implementer, so my preference would be to keep it as it is now but, Torsten / Mark / Phil also may have feedback.

Really?

The current doc has *no guidelines* on how to implement authorization tokens whatsoever.

So even if you like the current organization of the security considerations, I suspect you'll agree it would make sense to offer some guidance on how these tokens ought to be implemented.

---

From: Brian Eaton <[email-masked]>
Date: Thu, 7 Jul 2011 11:26:25 -0700

On Thu, Jul 7, 2011 at 11:08 AM, Anthony Nadalin <[email-masked]>wrote:

>  I was responding to the structure question only. The token text is
> questionable sine the tokens are opaque to the core, seems like the token
> write-up better belongs in the threat model document. Developers of the
> various token specs and use this as guidance and reference it.
>

OK, leaving aside the question of where the token text should end up, is the
text I sent technically correct and useful?

The proposed text is here:
http://www.ietf.org/mail-archive/web/oauth/current/msg06362.html.

---

From: Torsten Lodderstedt <[email-masked]>
Date: Fri, 08 Jul 2011 11:37:21 +0300

Hi Brian,

your text is definitely a valuable contribution. Please note: your earlier text on OAuth security considerations has already been incorporated into the security document. 

I would suggest to first incorporate your new text there (probably together with your proposal regarding redirect uri validation). Afterwards we can decide what we really need in the core spec's sec considerations section. 

When we wrote the first draft of this section, we intended to keep it focused on the essential MUSTs to be considered by implementors (client, as, rs). Otherwise we will blow up this section to much and none will read it. I would prefer to keep it that way.

Does this sound reasonable for you?

regards,
Torsten.