Subject: [Simple] draft-xml-patch and the security

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 6 Feb 2006 23:09:39 +0100

I have a few suggestions for the Security Considerations section:

Since a patch can potentially delete valuable information,
implementations should take care of authenticating the patches before
applying them, for instance with XML signature [RFC 3275] or transport
security, such as HTTP authentication [RFC 2617] if the patch is
served with HTTP.

In addition, an implementation MAY choose to limit what a patch can
do, by forbidding some operations such as <replace> or <delete> and/or
by limiting the amount of changes that can be done.

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple