* WGs marked with an * asterisk has had at least one new draft made available during the last 5 days

Ticket #348 (closed design: fixed)

Opened 2 years ago

Last modified 2 years ago

Realms and scope

Reported by: mnot@pobox.com Owned by: draft-ietf-httpbis-p7-auth@tools.ietf.org
Priority: normal Milestone: 20
Component: p7-auth Severity: In WG Last Call
Keywords: Cc:
Origin: http://www.w3.org/mid/CABkgnnUShc0fP_xX2FcuXuKBx2oQ_p2G4eK8PVQrqrfpdn8mug@mail.gmail.com>

Description

There's an implicit acknowledgement that one resource does not know about another (from p3):

A cache cannot assume that a representation with a Content-Location different from the URI used to retrieve it can be used to respond to later requests on that Content-Location URI.

However, the mechanism we use (and rely upon for performance) from p7 makes no concessions on that point. A server that operates separate fiefdoms by allocating different portions of path-space cannot prevent one vassal state from learning the secrets of any other that uses these authentication mechanisms we so love to hate.

For instance, if "/kind/and/naive" is authenticated in the realm "puppies", then "/kinda/shifty" can harvest their authentication information if a logged in user agent navigates there. See "log out" discussion for exacerbating stuff. User agents don't know (or care) for this distinction.

Of course, this is all pretty obvious, but is this worth acknowledging in Section 6?

Attachments

348.diff (1.9 KB) - added by julian.reschke@gmx.de 2 years ago.
Proposed patch

Change History

comment:1 Changed 2 years ago by julian.reschke@gmx.de

1) State it in sec cons

2) Note that new schemes should consider this

Changed 2 years ago by julian.reschke@gmx.de

Proposed patch

comment:2 Changed 2 years ago by mnot@pobox.com

Please incorporate and close.

comment:3 Changed 2 years ago by julian.reschke@gmx.de

From [1672]:

add security consideration wrt realms (see #348)

comment:4 Changed 2 years ago by julian.reschke@gmx.de

  • Status changed from new to closed
  • Resolution set to incorporated
  • Milestone changed from unassigned to 20

comment:5 Changed 2 years ago by mnot@pobox.com

  • Status changed from closed to reopened
  • Resolution incorporated deleted

comment:6 Changed 2 years ago by mnot@pobox.com

  • Status changed from reopened to closed
  • Resolution set to fixed
Note: See TracTickets for help on using tickets.