Subject: [OAUTH-WG] PAR - Guidance on the request URI structure needed?

From: Torsten Lodderstedt <[email-masked]>
Date: Sun, 26 Apr 2020 17:20:33 +0200

Hi all, 

another topic from last week’s virtual meeting. 

Shall there be guidance on the request URI structure? 

Please state your opinion. 

thanks in advance, 
Torsten.

---

From: Filip Skokan <[email-masked]>
Date: Mon, 27 Apr 2020 10:41:42 +0200

I believe implementers should be free to devise their own URIs and not be
locked down to one by the spec, at the same time,
and RFC6755 subnamespace would be good for guidance.

So, I would suggest it be RECOMMENDED to use e.g.
`urn:ietf:params:oauth:request_uri:<random>` (Brian's proposal) but also
that any URN or URL will do if the circumstances call for it.

Best,
*Filip*

On Sun, 26 Apr 2020 at 17:20, Torsten Lodderstedt <torsten=
[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Sascha Preibisch <[email-masked]>
Date: Mon, 27 Apr 2020 07:57:10 -0700

+1

On Mon, 27 Apr 2020 at 01:42, Filip Skokan <[email-masked]> wrote:
>
> I believe implementers should be free to devise their own URIs and not be locked down to one by the spec, at the same time, and RFC6755 subnamespace would be good for guidance.
>
> So, I would suggest it be RECOMMENDED to use e.g. `urn:ietf:params:oauth:request_uri:<random>` (Brian's proposal) but also that any URN or URL will do if the circumstances call for it.
>
> Best,
> Filip
>
>
> On Sun, 26 Apr 2020 at 17:20, Torsten Lodderstedt <torsten=[email-masked]> wrote:
>>
>> Hi all,
>>

---

From: Justin Richer <[email-masked]>
Date: Mon, 27 Apr 2020 12:58:09 -0400

I agree that any URI could be used but that it MUST be understood by the AS to be local to the AS (and not something that can be impersonated by an attacker). I wouldn’t even go so far as RECOMMENDED, but it’s certainly an option.

 — Justin

> On Apr 27, 2020, at 4:41 AM, Filip Skokan <[email-masked]> wrote:
> 
> On Sun, 26 Apr 2020 at 17:20, Torsten Lodderstedt <torsten=[email-masked] <mailto:[email-masked]>> wrote:
> Hi all, 
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>

---

From: Brian Campbell <[email-masked]>
Date: Mon, 27 Apr 2020 13:16:36 -0600

Yeah, I hadn't really been thinking of going so far as making it
RECOMMENDED either but more of just providing an easy option for those that
would choose to use it.

On Mon, Apr 27, 2020 at 10:58 AM Justin Richer <[email-masked]> wrote:

> I agree that any URI could be used but that it MUST be understood by the
> AS to be local to the AS (and not something that can be impersonated by an
> attacker). I wouldn’t even go so far as RECOMMENDED, but it’s certainly an
> option.
>
>  — Justin
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 27 Apr 2020 15:25:28 -0700

> I agree that any URI could be used but that it MUST be understood by the AS to be local to the AS (and not something that can be impersonated by an attacker). I wouldn’t even go so far as RECOMMEND…

IIUC BCP 190 has similar thoughts on the matter...

-Ben

---

From: Dave Tonge <[email-masked]>
Date: Tue, 28 Apr 2020 08:02:42 +0200

+1 to Filip's suggestion

-- 
Dave Tonge
CTO
<http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A>
Moneyhub Financial Technology, 5th Floor, 10 Temple Back, Bristol, BS1 6FL
t: +44 (0)117 280 5120

Moneyhub Enterprise is a trading style of Moneyhub Financial Technology
Limited which is authorised and regulated by the Financial Conduct
Authority ("FCA"). Moneyhub Financial Technology is entered on the
Financial Services Register (FRN 809360) at fca.org.uk/register.
Moneyhub Financial
Technology is registered in England & Wales, company registration number
06909772 .
Moneyhub Financial Technology Limited 2018 ©

DISCLAIMER: This email (including any attachments) is subject to copyright,
and the information in it is confidential. Use of this email or of any
information in it other than by the addressee is unauthorised and unlawful.
Whilst reasonable efforts are made to ensure that any attachments are
virus-free, it is the recipient's sole responsibility to scan all
attachments for viruses. All calls and emails to and from this company may
be monitored and recorded for legitimate purposes relating to this
company's business. Any opinions expressed in this email (or in any
attachments) are those of the author and do not necessarily represent the
opinions of Moneyhub Financial Technology Limited or of any other group
company.