Subject: [OAUTH-WG] [Fwd: [oauth] Re: Signing PUT request]

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 16 Sep 2009 19:18:54 -0600

FYI.

- -------- Original Message --------
Subject: [oauth] Re: Signing PUT request
Date: Wed, 16 Sep 2009 19:17:43 -0600
From: Peter Saint-Andre <[email-masked]>
Reply-To: [email-masked]
To: [email-masked]

On 9/16/09 6:31 PM, Hannes Tydén wrote:
> On Sep 17, 1:12 am, Hans Granqvist <[email-masked]> wrote:
>
>> seems to leave PUT requests with form-encoded name/value pairs in a
>> bad spot, not covered by the core spec (which only deals with POSTs),
>> nor covered by the body hash spec.
>
> I will rephrase my initial question:
> Is it true that the base string for "application/x-www-form-
> urlencoded" PUT requests should not contain the parameters in the
> request body according to the 1.0 core specification?
>
> Section "9.1.1 Normalize Request Parameters" (http://oauth.net/core/
> 1.0#anchor14) says:
> "Parameters in the HTTP POST request body (with a content-type of
> application/x-www-form-urlencoded)."
>
> If "HTTP POST request body" should be interpreted as "the request body
> if it is a POST request", "application/x-www-form-urlencoded" PUT
> requests are wide open for man-in-the-middle attacks.
>
> If it should be interpreted as "the request body of any kind of
> request", I'm fine with this and we could move along.

That seems to be the most reasonable interpretation.

> In any case the wording is too ambiguous, leaving room for
> interpretation. I'd suggest that an amendment should be done to the
> specification.

IMHO this needs to be clarified in the Internet-Draft. I'll forward this
message to [email-masked] list.

Peter

- --~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google
Groups "OAuth" group.
To post to this group, send email to [email-masked]
To unsubscribe from this group, send email to
[email-masked]
For more options, visit this group at
http://groups.google.com/group/oauth?hl=en
- -~----------~----~----~----~------~----~------~--~---

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 17 Sep 2009 00:50:55 -0700

Not an issue. The current language is:

   The request parameters, which include both protocol parameters and
   request-specific parameters, are extracted and restored to their
   original unencoded form, from the following sources:

   o  The OAuth HTTP Authorization header (Section 7.1).  The "realm"
      parameter MUST be excluded if present.

   o  The HTTP request entity-body, but only if:

      *  The entity-body is single-part.

      *  The entity-body follows the encoding requirements of the
         "application/x-www-form-urlencoded" content-type as defined by
         [W3C.REC-html40-19980424].

      *  The HTTP request entity-header includes the "Content-Type"
         header set to "application/x-www-form-urlencoded".

   o  The query component of the HTTP request URI as defined by
      [RFC3986] section 3.

   The "oauth_signature" parameter MUST be excluded if present.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Peter Saint-Andre
> Sent: Wednesday, September 16, 2009 6:19 PM
> To: [email-masked]
> Subject: [OAUTH-WG] [Fwd: [oauth] Re: Signing PUT request]
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> FYI.
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAkqxjn4ACgkQNL8k5A2w/vxcfQCggVPhFeyrgkktxtZyKRH0uHfO
> +VMAoPiltQS/Nv4hRM0kwrTqWaxMYXSJ
> =iCi/
> -----END PGP SIGNATURE-----
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 17 Sep 2009 07:32:57 -0600

On 9/17/09 1:50 AM, Eran Hammer-Lahav wrote:
> Not an issue. 

Great. The fewer issues the better. :)

Peter

- --
Peter Saint-Andre
https://stpeter.im/