Subject: [OAUTH-WG] Issue 16, revised Redirection URI section (3.1.2)

From: Torsten Lodderstedt <[email-masked]>
Date: Wed, 20 Jul 2011 23:15:00 +0200

"The authorization server redirects the user-agent to the
    client's redirection URI previously established with the
    authorization server during the client registration process."

Conflicts with section 3.1.2.3, which allows to pass a redirect_uri via 
URI query parameter.

3.1.2.1 Endpoint Confidentiality

What does "endpoint" confidentiality mean? Which endpoint does this text 
refer to? The client's redirect_uri endpoint?

The text, in my opinion, covers two different scenarios:
first paragraph: confidentiality of access tokens and authz codes in 
transit.
second paragraph/last sentence: men-in-the-middle attacks

Those attacks are also covered in sections 10.5 and 10.8.

3.1.2.5. Endpoint Content

As this section discusses security aspects of the client's 
implementation of the redirect_uri page, shouldn't this go to the 
security considerations section?

regards,
Torsten.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 25 Jul 2011 00:28:09 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Torsten Lodderstedt
> Sent: Wednesday, July 20, 2011 2:15 PM

> Conflicts with section 3.1.2.3, which allows to pass a redirect_uri via URI
> query parameter.

Added 'or when initiating the authorization request'
 
> refer to? The client's redirect_uri endpoint?

This is a sub-section of the Redirection URI endpoint.

> As this section discusses security aspects of the client's implementation of
> the redirect_uri page, shouldn't this go to the security considerations
> section?

I think it is important enough to appear earlier. It is part of my effort to integrate concrete normative language from the security sections up to the protocol sections.

EHL

---

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 25 Jul 2011 10:18:39 -0400

Hi Eran,

> This is a sub-section of the Redirection URI endpoint.

ok, but how can an endpoint be confidential?

> I think it is important enough to appear earlier. It is part of my effort to integrate concrete normative language from the security sections up to the protocol sections.

Understood and in support for this approach. Wouldn't this mean to 
remove some text from section 10 in order to prevent redundancies? 
Regarding this particular section: I think the two different issues 
(transport security and endpoint authenticity) should be presented 
separately.

regards,
Torsten.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 25 Jul 2011 08:47:08 -0700

> From: Torsten Lodderstedt [mailto:[email-masked]]
> Sent: Monday, July 25, 2011 7:19 AM
> To: Eran Hammer-Lahav
> Cc: OAuth WG
> Subject: Re: [OAUTH-WG] Issue 16, revised Redirection URI section (3.1.2)
> 
> Hi Eran,
> 
> >> From: [email-masked] [mailto:[email-masked]] On
> >> Behalf Of Torsten Lodderstedt
> >> Sent: Wednesday, July 20, 2011 2:15 PM "The authorization server
> >> redirects the user-agent to the
> >> Conflicts with section 3.1.2.3, which allows to pass a redirect_uri
> >> via URI query parameter.
> >> What does "endpoint" confidentiality mean? Which endpoint does this
> >> text refer to? The client's redirect_uri endpoint?

Good point. I'll change it to 'Endpoint Request Confidentiality'.

> > I think it is important enough to appear earlier. It is part of my effort to
> integrate concrete normative language from the security sections up to the
> protocol sections.
> >
> 
> Understood and in support for this approach. Wouldn't this mean to remove
> some text from section 10 in order to prevent redundancies?

Which text? Duplication of security text is fine as long as it is consistent.

> Regarding this particular section: I think the two different issues (transport
> security and endpoint authenticity) should be presented separately.

Which section?

EHL

---

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 25 Jul 2011 13:26:46 -0400

Hi Eran,

>> security and endpoint authenticity) should be presented separately.

3.1.2.1.

regards,
Torsten.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 25 Jul 2011 15:20:07 -0700

Since these issues are covered in the security section, I think it is enough to simply stress the importance of using TLS for the redirection endpoint and leave the more detailed analysis for later in the document.

But if you want to propose new text, I'm open to it.

EHL

> Sent: Monday, July 25, 2011 10:27 AM
> To: Eran Hammer-Lahav
> Cc: OAuth WG