Subject: [webfinger] Security considerations about redirect loops

From: Mike Jones <[email-masked]>
Date: Sat, 12 Jan 2013 01:45:58 +0000

Should we add text to the Security Considerations section about preventing redirect loops?  For instance, saying that clients may only want to redirect a limited number of times?

Surely there must be existing text on this issue that we can reuse from other specs?  Any examples from experts out there?

                                                                Thanks,
                                                                -- Mike

---

From: Brad Fitzpatrick <[email-masked]>
Date: Fri, 11 Jan 2013 17:49:27 -0800

Where do you do draw the line, though?  Taken to an extreme we would also
warn against normal infinite loops, or against using CPU-wasting and
security-bug-ridden languages.

Easier to say nothing and let people use common sense.

On Fri, Jan 11, 2013 at 5:45 PM, Mike Jones <[email-masked]>wrote:

>  Should we add text to the Security Considerations section about
> preventing redirect loops?  For instance, saying that clients may only want
> to redirect a limited number of times?****
>
> ** **
>
> Surely there must be existing text on this issue that we can reuse from
> other specs?  Any examples from experts out there?****
>
> ** **
>
>                                                                 Thanks,***
> *
>
>                                                                 -- Mike***
> *
>
> ** **
>
> _______________________________________________
> webfinger mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webfinger
>
>

---

From: Mike Jones <[email-masked]>
Date: Sat, 12 Jan 2013 01:57:25 +0000

I’d also be OK with us making an explicit decision not to mention the issue.  The issue had been raised about Simple Web Discovery and so I wanted to redirect that discussion to WebFinger (pun intended ;-) ).

                                                                -- Mike

From: Brad Fitzpatrick [mailto:[email-masked]]
Sent: Friday, January 11, 2013 5:49 PM
To: Mike Jones
Cc: [email-masked]
Subject: Re: [webfinger] Security considerations about redirect loops

Where do you do draw the line, though?  Taken to an extreme we would also warn against normal infinite loops, or against using CPU-wasting and security-bug-ridden languages.

On Fri, Jan 11, 2013 at 5:45 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
Should we add text to the Security Considerations section about preventing redirect loops?  For instance, saying that clients may only want to redirect a limited number of times?

                                                                Thanks,
                                                                -- Mike

_______________________________________________
webfinger mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/webfinger

---

From: Evan Prodromou <[email-masked]>
Date: Fri, 11 Jan 2013 21:41:17 -0500

At the risk of causing a redirect loop here, I wonder if pointing to RFC 
2616's security considerations and saying, "This is an HTTP-based 
mechanism, and many HTTP-based security considerations apply here" would 
be sufficient.

That said, I couldn't find a mention of redirect loops in particular in 
RFC 2616.

http://tools.ietf.org/html/rfc2616#section-15

-Evan

On 13-01-11 08:57 PM, Mike Jones wrote:
>
> I'd also be OK with us making an explicit decision not to mention the 
> issue.  The issue had been raised about Simple Web Discovery and so I 
> wanted to redirect that discussion to WebFinger (pun intended ;-) ).
>
> -- Mike
>
> *From:*Brad Fitzpatrick [mailto:[email-masked]]
> *Sent:* Friday, January 11, 2013 5:49 PM
> *To:* Mike Jones
> *Cc:* [email-masked]
> *Subject:* Re: [webfinger] Security considerations about redirect loops
>
> Where do you do draw the line, though?  Taken to an extreme we would 
> also warn against normal infinite loops, or against using CPU-wasting 
> and security-bug-ridden languages.
>
> On Fri, Jan 11, 2013 at 5:45 PM, Mike Jones 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
> preventing redirect loops?  For instance, saying that clients may only 
> want to redirect a limited number of times?
>
> Surely there must be existing text on this issue that we can reuse 
> from other specs?  Any examples from experts out there?
>
> Thanks,
>
> -- Mike
>
>
> [email-masked] <mailto:[email-masked]>