Subject: Re: [OAUTH-WG] New OAuth DPoP and Security BCP drafts

From: Sascha Preibisch <[email-masked]>
Date: Thu, 1 Aug 2019 13:43:37 -0700

Hi all!

I am reading through the latest draft ( ... dpop-02). When I got to
the first example request (bullet 5.) I saw that only 'grant_type,
code, redirect_uri' are used.

If I am not mistaken the recommendation is to generally use PKCE with
an authorization_code flow. Therefore, I wondered if the example
should also include a 'code_verifier'.

Thanks,
Sascha

On Mon, 8 Jul 2019 at 06:30, Daniel Fett <[email-masked]> wrote:
>
> All,
>
> In preparation for the meeting in Montreal, I just uploaded a new version of the DPoP draft:
> https://tools.ietf.org/html/draft-fett-oauth-dpop-02
>
> Please have a look and let me know what you think. We should make this a working group item soon.
>
> As you might have noticed, there is also a new version of the Security Best Current Practice draft:
> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13
>
> -Daniel
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Paul Querna <[email-masked]>
Date: Mon, 12 Aug 2019 20:24:04 -0700

I've updated the dpop in go implementation to -02:
https://github.com/pquerna/dpop

Compared to implementing -01, because the same proof is used against
the token requests and resource server access, it did generally
simplify the implementation risk and complexity.

Getting the private key fingerprint into the Access Token or
introspect response seems like the highest barrier to wide adoption,
and not something that a dpop library can directly tackle making
easier -- but I don't have any magical ideas to make it better.

---

From: Brian Campbell <[email-masked]>
Date: Wed, 14 Aug 2019 13:24:09 -0600

It can be a bit of a balancing act to have examples that clearly and
concisely demonstrate the target functionality of the document but do so in
the context of an otherwise complete and valid protocol message that also
shows best practices being adhered to. But I think in this case I agree
that adding a code_verifier to that example is worthwhile to show one of
the generally agreed on best practices being followed and it doesn't add
too much bloat to the example.

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._