Subject: [OAUTH-WG] Working Group Last Call: JSON Web Token Best Current Practices

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 16 Apr 2018 17:49:25 +0000

Hi all,

this is a last call for comments on
https://tools.ietf.org/html/draft-ietf-oauth-jwt-bcp-01

Please have your comments in no later than April 30th.

Do remember to send a note in if you have read the document and have no other comments other than "its ready to go" - we need those as much as we need "I found a problem".

Ciao
Hannes & Rifaat
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Mike Jones <[email-masked]>
Date: Mon, 16 Apr 2018 18:52:06 +0000

The JWT BCP spec is ready to publish.

				-- Mike

-----Original Message-----
From: OAuth <[email-masked]> On Behalf Of Hannes Tschofenig
Sent: Monday, April 16, 2018 10:49 AM
To: oauth <[email-masked]>
Subject: [OAUTH-WG] Working Group Last Call: JSON Web Token Best Current Practices

Hi all,

Ciao
Hannes & Rifaat

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 17 Apr 2018 12:24:38 +0200

I haven’t read the document yet, but idnits did some reading for me:

  ** The document seems to lack a Security Considerations section.

  ** The abstract seems to contain references ([RFC7519]), which it
     shouldn't.  Please replace those with straight textual mentions of the
     documents in question.

  ** Obsolete normative reference: RFC 7159 (Obsoleted by RFC 8259)

I’ll get to the content later…

Grüße, Carsten

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 17 Apr 2018 13:58:35 +0200

>  ** Obsolete normative reference: RFC 7159 (Obsoleted by RFC 8259)

That also gives rise to:

Minor technical comment: 2.3 claims that JSON can be in different encodings.  This is no longer really the case with RFC 8259 (see Section 8.1).  Please fix the wording to remove the untrue claim (no pun intended).

Major technical comment: Section 3.9 recommends the use of media types 
of the form application/example+jwt.
I don’t find a registration for the RFC 6839 structured syntax
suffix "+jwt".  If this recommendation is desired, this document will
need to register it (preferred) or refer to a document that does.

Nit: Section 1.2 could use the newer template (as per RFC 8174) here.
Nit: Section 3.6: s/use/use or admit the use of/
Nit: Section 3.8: s/not/not present or not/

I think these are all solved in an obvious way, and once done I strongly support this document to go forward.

Grüße, Carsten