Subject: [OAUTH-WG] FYI - Text resolving DISCUSS issue about Bearer URI Query Parameter method

From: Mike Jones <[email-masked]>
Date: Thu, 17 May 2012 22:11:12 +0000

Dear working group members:

I'm going through the remaining open issues that have been raised about the Bearer spec so as to be ready to publish an updated draft once the outstanding consensus call issues are resolved.

This DISCUSS had been raised about the URI Query Parameter method:

   * Section 2.3 URI Query Parameter

   This section effectively reserves a URI query parameter for the

    draft's use. This should not be done lightly, since this would be a

    precedent for the IETF encroaching upon a server's URIs (done

    previously in RFC5785, but in a much more limited fashion, as a

    tactic to prevent further, uncontrolled encroachment).

   Given that the draft already discourages the use of this mechanism,

    I'd recommend dropping it altogether. If the Working Group wishes it

    to remain, this issues should be vetted both through the APPS area

    and the W3C liaison.

I wanted to let you know that the agreed-upon resolution to this issue is to add the following text to the URI Query Parameter section:

    This method is included to document current use; its use is

    NOT RECOMMENDED, both due to its security deficiencies (see

    Security Considerations) and because it uses a reserved query

    parameter name, which is counter to URI namespace best

    practices [W3C TAG WebArch].

The reference above is to http://www.w3.org/TR/webarch/.

Thanks to Mark Nottingham, Stephen Farrell, Pete Resnick, and Dick Hardt for helping us get to this resolution.

                                                                Cheers,
                                                                -- Mike

---

From: William Mills <[email-masked]>
Date: Thu, 17 May 2012 15:33:35 -0700 (PDT)

wfm

>________________________________
> From: Mike Jones <[email-masked]>
>To: "[email-masked]" <[email-masked]> 
>Cc: Mark Nottingham <[email-masked]> 
>Sent: Thursday, May 17, 2012 3:11 PM
>Subject: [OAUTH-WG] FYI - Text resolving DISCUSS issue about Bearer URI Query Parameter method
> 
>
> 
>_______________________________________________
>OAuth mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/oauth
>
>
>

---

From: Julian Reschke <[email-masked]>
Date: Fri, 18 May 2012 09:15:15 +0200

On 2012-05-18 00:11, Mike Jones wrote:
> I'm going through the remaining open issues that have been raised about
> the Bearer spec so as to be ready to publish an updated draft once the
> outstanding consensus call issues are resolved.
>
> I wanted to let you know that the agreed-upon resolution to this issue
> is to add the following text to the URI Query Parameter section:
>
> ...

Did you consider to *also* move the whole section into an appendix, so 
that it's status is also reflected by the document structure?

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Thu, 24 May 2012 08:35:44 +0200

> that it's status is also reflected by the document structure?

Hi, it would be awesome to see feedback on this (it has been mentioned 
during IETF LC multiple times).

Best regards, Julian

---

From: David Recordon <[email-masked]>
Date: Wed, 23 May 2012 23:46:38 -0700

I'm confused by this change given the access_token (or oauth_token)
parameter being the most widely deployed usage of the protocol over the
past eighteen months:

 * https://developers.facebook.com/docs/reference/api/
 * https://developers.google.com/accounts/docs/OAuth2WebServer#callinganapi
 * http://msdn.microsoft.com/en-us/library/live/hh243647#response
 * http://develop.github.com/p/oauth.html

--David

On Wed, May 23, 2012 at 11:35 PM, Julian Reschke <[email-masked]>wrote:

> ______________________________**_________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/oauth<https://www.ietf.org/mailman/listinfo/oauth>
>

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 24 May 2012 16:48:32 +1000

RFCs tend to last longer than 18 months. And many companies.

Thanks,

On 24/05/2012, at 4:46 PM, David Recordon wrote:

> I'm confused by this change given the access_token (or oauth_token) parameter being the most widely deployed usage of the protocol over the past eighteen months:
> 
> On Wed, May 23, 2012 at 11:35 PM, Julian Reschke <[email-masked]> wrote:
> Hi, it would be awesome to see feedback on this (it has been mentioned during IETF LC multiple times).
> 
> 
> Best regards, Julian

--
Mark Nottingham   http://www.mnot.net/

---

From: Mike Jones <[email-masked]>
Date: Thu, 24 May 2012 06:48:47 +0000

Yes, putting the query parameter method into an appendix was considered and explicitly rejected.  Dick Hardt wrote about these issues in the discussions that led to this decision, and I'll take the liberty of quoting him, as I believe he explained it well:

"The reality is that the world is a messy place. Developers hack the architecture to accomplish goals not envisioned by the architects. The architects can accept the reality of the world, or ignore it and lose their relevance. In my opinion, putting the query parameter mechanism into an appendix is ignoring the reality of current implementations. Adding language to the spec that use of the query parameter is not architecturally ideal, but accepts the reality of the current web would be far more preferable."

"Many sites with substantial security expertise (Google, Facebook, LinkedIn, Foursquare) have chosen to use the query parameter as opposed to the header - both methods have been documented in the drafts since the beginning. Clearly from a practical point of view the implementers have chosen to use the query parameter. "

"I have read people proposing dropping it from the spec or pushing it to an Appendix. I agree that the security issues need to be documented and the architectural issues called out. I think dropping it from the spec or pushing it to an appendix is a disservice to implementers and sends a message that the IETF is not in touch with the realities of the web."

					-- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]] 
Sent: Wednesday, May 23, 2012 11:36 PM
To: Mike Jones
Cc: [email-masked]; Mark Nottingham
Subject: Re: [OAUTH-WG] FYI - Text resolving DISCUSS issue about Bearer URI Query Parameter method

Best regards, Julian

---

From: Mike Jones <[email-masked]>
Date: Thu, 24 May 2012 06:51:02 +0000

The query parameter method was not moved to an appendix, for the reasons that Dick and you stated.  The reality is, that it's the most used method, and it would be a disservice to developers not to describe it in the body of the spec (with appropriate caveats, of course).

                                                            Best wishes,
                                                            -- Mike

From: David Recordon [mailto:[email-masked]]
Sent: Wednesday, May 23, 2012 11:47 PM
To: Mike Jones; Julian Reschke
Cc: Mark Nottingham; [email-masked]
Subject: Re: [OAUTH-WG] FYI - Text resolving DISCUSS issue about Bearer URI Query Parameter method

--David

On Wed, May 23, 2012 at 11:35 PM, Julian Reschke <[email-masked]<mailto:[email-masked]>> wrote:
On 2012-05-18 09:15, Julian Reschke wrote:
...
Did you consider to *also* move the whole section into an appendix, so
that it's status is also reflected by the document structure?

Best regards, Julian

Best regards, Julian
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Eran Hammer <[email-masked]>
Date: Thu, 24 May 2012 06:53:07 +0000

I don't care about this either way, but 'explicitly rejected' is an over-reach. I have not seen the chairs make a consensus call about that, or even formally ask the list.

EH

> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Mike Jones
> Sent: Wednesday, May 23, 2012 11:49 PM
> To: Julian Reschke
> Yes, putting the query parameter method into an appendix was considered
> and explicitly rejected.  Dick Hardt wrote about these issues in the
> discussions that led to this decision, and I'll take the liberty of quoting him, as
> I believe he explained it well:
> 
> "The reality is that the world is a messy place. Developers hack the
> architecture to accomplish goals not envisioned by the architects. The
> architects can accept the reality of the world, or ignore it and lose their
> relevance. In my opinion, putting the query parameter mechanism into an
> appendix is ignoring the reality of current implementations. Adding language
> to the spec that use of the query parameter is not architecturally ideal, but
> accepts the reality of the current web would be far more preferable."
> 
> "Many sites with substantial security expertise (Google, Facebook, LinkedIn,
> Foursquare) have chosen to use the query parameter as opposed to the
> header - both methods have been documented in the drafts since the
> beginning. Clearly from a practical point of view the implementers have
> chosen to use the query parameter. "
> 
> "I have read people proposing dropping it from the spec or pushing it to an
> Appendix. I agree that the security issues need to be documented and the
> architectural issues called out. I think dropping it from the spec or pushing it
> to an appendix is a disservice to implementers and sends a message that the
> IETF is not in touch with the realities of the web."
> 
> 					-- Mike
>

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 24 May 2012 16:53:45 +1000

Thanks, Eran - I was just about to ask about that.

---

From: Mike Jones <[email-masked]>
Date: Thu, 24 May 2012 07:02:14 +0000

My recollection is that putting it in an appendix was explicitly rejected in the threads discussing the DISCUSS issues and no one on those threads pushed back afterwards, particularly after Dick's explanations of why it should stay.  (Why these DISCUSS discussions don't include the full working group is a mystery to me, but apparently that's the way it's done at this stage of the IETF spec finalization process.  Can anyone tell me why that's the case?)

Anyway, since this feature has been in *every* version of the spec, leaving it in hardly seemed to require a consensus call.  The chairs, of course, can obviously hold one if they believe one is called for.

				Best wishes,
				-- Mike

-----Original Message-----
From: Mark Nottingham [mailto:[email-masked]] 
Sent: Wednesday, May 23, 2012 11:54 PM
To: Eran Hammer
Cc: Mike Jones; Julian Reschke; [email-masked]
Subject: Re: [OAUTH-WG] FYI - Text resolving DISCUSS issue about Bearer URI Query Parameter method

On 24/05/2012, at 4:53 PM, Eran Hammer wrote:

>> From: [email-masked] [mailto:[email-masked]] On 
>> Behalf Of Mike Jones
>> Yes, putting the query parameter method into an appendix was 
>> considered and explicitly rejected.  Dick Hardt wrote about these 
>> issues in the discussions that led to this decision, and I'll take 
>> the liberty of quoting him, as I believe he explained it well:
>> 
>> architecture to accomplish goals not envisioned by the architects. 
>> The architects can accept the reality of the world, or ignore it and 
>> lose their relevance. In my opinion, putting the query parameter 
>> mechanism into an appendix is ignoring the reality of current 
>> implementations. Adding language to the spec that use of the query 
>> parameter is not architecturally ideal, but accepts the reality of the current web would be far more preferable."
>> 
>> beginning. Clearly from a practical point of view the implementers 
>> have chosen to use the query parameter. "
>> 
>> "I have read people proposing dropping it from the spec or pushing it 
>> to an Appendix. I agree that the security issues need to be 
>> documented and the architectural issues called out. I think dropping 
>> it from the spec or pushing it to an appendix is a disservice to 
>> implementers and sends a message that the IETF is not in touch with the realities of the web."
>> 
>> 					-- Mike
>> 
>>> Did you consider to *also* move the whole section into an appendix, 
>>> so that it's status is also reflected by the document structure?
>>> 
>>> Best regards, Julian
>> 
>> Hi, it would be awesome to see feedback on this (it has been 
>> mentioned during IETF LC multiple times).
>> 
>> Best regards, Julian
>> 
>>

---

From: David Recordon <[email-masked]>
Date: Thu, 24 May 2012 00:11:20 -0700

Regardless of how we got here, just feels strange to have a
strong recommendation against the way the protocol is actually being used.
I completely understand that standards live on for well over eighteen
months (or five years if we start with OAuth 1.0) but this feels like we're
just going to end up with the vast majority of deployments doing what the
standard explicitly recommends against. Query parameters are used because
they're easy and implementor simplicity was always something driving design
decisions. So at least to me this is not the path toward a widely deployed
standard.

--David

On Thu, May 24, 2012 at 12:02 AM, Mike Jones <[email-masked]>wrote:

> My recollection is that putting it in an appendix was explicitly rejected
> in the threads discussing the DISCUSS issues and no one on those threads
> pushed back afterwards, particularly after Dick's explanations of why it
> should stay.  (Why these DISCUSS discussions don't include the full working
> group is a mystery to me, but apparently that's the way it's done at this
> stage of the IETF spec finalization process.  Can anyone tell me why that's
> the case?)
>
> Anyway, since this feature has been in *every* version of the spec,
> leaving it in hardly seemed to require a consensus call.  The chairs, of
> course, can obviously hold one if they believe one is called for.
>
>                                Best wishes,
>                                -- Mike
>
> > I don't care about this either way, but 'explicitly rejected' is an
> over-reach. I have not seen the chairs make a consensus call about that, or
> even formally ask the list.
> >
> > EH
> >
> >
> >> parameter is not architecturally ideal, but accepts the reality of the
> current web would be far more preferable."
> >>

---

From: Julian Reschke <[email-masked]>
Date: Thu, 24 May 2012 09:37:06 +0200

> Anyway, since this feature has been in *every* version of the spec, leaving it in hardly seemed to require a consensus call.  The chairs, of course, can obviously hold one if they believe one is ca…

It is very awkward to have the spec define three ways to do things, and 
have one of them marked as "NOT RECOMMENDED" (== "SHOULD NOT"), but 
leave it in the same place as the two other methods that are actually 
supposed to be used.

The NOT RECOMMENDED is to discourage use. *Keeping* the text is a 
compromise because of wide deployment, but then moving the text into an 
appendix reflecting the normative status should not negatively affect 
deployments, right?

Best regards, Julian

---

From: William Mills <[email-masked]>
Date: Thu, 24 May 2012 00:46:05 -0700 (PDT)

And yet, the security properties of query parameters make them not ideal for credentials.  From a security perspective it is hard to justify recommending it.

> From: David Recordon <[email-masked]>
>To: Mark Nottingham <[email-masked]>; Eran Hammer <[email-masked]>; Mike Jones <[email-masked]> 
>Cc: Julian Reschke <[email-masked]>; "[email-masked]" <[email-masked]> 
>Sent: Thursday, May 24, 2012 12:11 AM
>Regardless of how we got here, just feels strange to have a strong recommendation against the way the protocol is actually being used. I completely understand that standards live on for well over eighteen months (or five years if we start with OAuth 1.0) but this feels like we're just going to end up with the vast majority of deployments doing what the standard explicitly recommends against. Query parameters are used because they're easy and implementor simplicity was always something driving design decisions. So at least to me this is not the path toward a widely deployed standard.
>
>
>--David
>
>
>
>
>
>On Thu, May 24, 2012 at 12:02 AM, Mike Jones <[email-masked]> wrote:
>

---

From: Derek Atkins <[email-masked]>
Date: Thu, 24 May 2012 09:58:36 -0400

David,

David Recordon <[email-masked]> writes:

> strong recommendation against the way the protocol is actually being used. I
> completely understand that standards live on for well over eighteen months (or
> five years if we start with OAuth 1.0) but this feels like we're just going to
> end up with the vast majority of deployments doing what the

(speaking as a participant, not the chair)

Just because everyone currently with a gun happens to enjoy shooting
themselves in the foot with it does not imply that we should recommend
that future gun owners shoot themselves in the foot, too.

The applications area, and the HTTP gurus in particular, have strong
opinions about the dangers of standardizing query parameters, with
strong technical arguments about how it is problematic and downright
dangerous.  Historically the query string has been opaque to the
protocol, and now you're asking for it to be less opaque; they object to
that, and rightfully so.

I have no personal preference as to whether we leave this in the main
text or move it into an appendix.  I don't see any harm in leaving it in
the main text with the warning that it's not recommended.  As you point
out, it IS widely deployed.

> --David

-derek

>     should stay.  (Why these DISCUSS discussions don't include the full
>     working group is a mystery to me, but apparently that's the way it's done
>     at this stage of the IETF spec finalization process.  Can anyone tell me
>     why that's the case?)
>    
>     over-reach. I have not seen the chairs make a consensus call about that,
>     or even formally ask the list.
>     >
>     > EH
>     >
>     >

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant