Re: [Acme] ACME signature mechanics

["Manger, James" <[e-mail]>]

2. Appending ‘path’ to ‘.well-known/acme-challenge’ as part of a simpleHttps challenge (section 6.1) looks dangerous if not done carefully. What if ‘path’ is “../../user/alice/whatever”?

Suggestion: I would be tempted to say: “take the ‘path’ string value, UTF-8 encode it, base64url-encode those bytes, then append to ‘.well-known/acme-challenge’”.

> Good point.  It seems like a simpler solution would just be to require that the "path" value meet a certain ABNF, e.g., the URL-safe base64 alphabet.  The only reason that the client provides the path is to let it avoid collisions if it has multiple validations in progress, so there's not a need for it to be especially expressive.

That might be simpler, but it relies on clients doing input validation on ‘path’. Telling the client to B64 whatever it gets might be just a smidgen safer.

--
James Manger