Subject: Re: [OAUTH-WG] WGLC for "OAuth 2.0 Security Best Current Practice"

From: n-sakimura <[email-masked]>
Date: Wed, 4 Dec 2019 10:09:06 +0000

Sorry to chime in so late as well as I have not been able to follow up all the mail in the tread, so it may have come up before but just for the sake... 

1) Spelling of "OpenID"
"OpenID" is sometimes spelled "OpenID" and sometimes " OpenId". 
Please unify to "OpenID" as that is the official way of expressing it. 
Of course, it does not apply to the URIs. 

2) Has WPAD/PAC attack been mitigated in all user-agents? 

WPAD/PAC used to trivially leak the request URIs (in terms of HTTP, not OAuth) in some browsers that were configured to use proxy auto-config. So, in that kind of scenario, both Authorization Request URI and Authorization Response URI would have leaked. 
(Depending on the HTTP agent that the client uses, it would have leaked its requests as well though they are typically not auto-configured so are save in most cases.) 
Did those browsers disappeared? (Hopefully yes but not sure.) 
If not, it might be worth adding it. 

Best, 

Nat Sakimura
---------------------------------------------------------
PLEASE READ:This e-mail is confidential and intended for the named recipient only. If you are not an intended recipient, please notify the sender and delete this e-mail.

-----Original Message-----
From: OAuth <[email-masked]> On Behalf Of Hannes Tschofenig
Sent: Wednesday, November 6, 2019 5:27 PM
To: [email-masked]
Subject: [OAUTH-WG] WGLC for "OAuth 2.0 Security Best Current Practice"

Hi all,

this is a working group last call for "OAuth 2.0 Security Best Current Practice".

Here is the document:
https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13

Please send you comments to the OAuth mailing list by Nov. 27, 2019.
(We use a three week WGLC because of the IETF meeting.)

Ciao
Hannes & Rifaat

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth