Subject: [OAUTH-WG] Cache-control for Authorization server

From: [email-masked]
Date: Tue, 13 Apr 2010 16:23:20 +0200

All,

I think the draft should explicitly state that the Authorization server 
MUST use Cache-Control: no-store on all responses that contain tokens 
or other sensitive information, since this is critical to the security 
properties of the protocol

Regards,
Jeroen

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 13 Apr 2010 08:22:19 -0700

Is this really a MUST?

EHL

On 4/13/10 7:23 AM, "[email-masked]" <[email-masked]> wrote:

All,

Regards,
Jeroen
_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Jeroen van Bemmel <[email-masked]>
Date: Wed, 14 Apr 2010 09:15:17 +0200

Since HTTPS is used, intermediate proxies aren't a problem. However, a 
browser might store the response containing the token in "Temporary 
Internet files" or similar locations, and rich clients often use the 
same HTTP libraries as the browser. Since the server cannot make any 
assumptions about which software is being used on the client side, we 
have to assume the worst - hence 'MUST' to reduce the chance of tokens 
being exposed to other programs / malware running on the same machine

Of course this still does not guarantee that tokens don't get 
stored/cached in insecure places, but it reduces the likelihood.

Regards,
Jeroen

---

From: Richard Barnes <[email-masked]>
Date: Wed, 14 Apr 2010 10:19:21 +0300

This argument makes sense to me.

EHL: Do you have an exception in mind?

On Apr 14, 2010, at 10:15 AM, Jeroen van Bemmel wrote:

> Since HTTPS is used, intermediate proxies aren't a problem. However,  
> a browser might store the response containing the token in  
> "Temporary Internet files" or similar locations, and rich clients  
> often use the same HTTP libraries as the browser. Since the server  
> cannot make any assumptions about which software is being used on  
> the client side, we have to assume the worst - hence 'MUST' to  
> reduce the chance of tokens being exposed to other programs /  
> malware running on the same machine
>
> Of course this still does not guarantee that tokens don't get stored/ 
> cached in insecure places, but it reduces the likelihood.
>
> Regards,
> Jeroen
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 14 Apr 2010 01:06:41 -0700

Nope. Since HTTPS is a SHOULD I just wanted to ask. I'll add it.

EHL