[apps-discuss] FW: New Version Notification for draft-vyncke-v6ops-happy-eyeballs-cookie-01.txt

"Eric Vyncke (evyncke)" <evyncke@cisco.com> Fri, 06 March 2015 14:12 UTC

From: "Eric Vyncke (evyncke)" <evyncke@cisco.com>
To: "apps-discuss@ietf.org" <apps-discuss@ietf.org>
Thread-Topic: New Version Notification for draft-vyncke-v6ops-happy-eyeballs-cookie-01.txt
Thread-Index: AQHQV+OAmfOoS9exuUuMXePFUNM3gp0P9LIA
Date: Fri, 06 Mar 2015 14:12:22 +0000
Message-ID: <D11F722B.3F1D4%evyncke@cisco.com>
References: <20150306075938.24593.60303.idtracker@ietfa.amsl.com>
In-Reply-To: <20150306075938.24593.60303.idtracker@ietfa.amsl.com>
Accept-Language: fr-FR, en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/14.4.6.141106
Content-Type: text/plain; charset="utf-8"
Content-ID: <D5C70AD6CE8C8940910FC719487307FF@emea.cisco.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/apps-discuss/4Cg8W_X4N6q75AZeI11BQuXDbL4>
Subject: [apps-discuss] FW: New Version Notification for draft-vyncke-v6ops-happy-eyeballs-cookie-01.txt
Precedence: list

You may find this short I-D interesting: it is related to all application
using cookie (or any state) linked on an IP address in a world where user
agents are dual-stack, are NAT by carrier-grade NAT, are multi-homed, ...
=> the mapping IP_address <=> user which was never correct is becoming
more and more wrong :-)

Comments are obviously welcome

-éric

On 6/03/15 08:59, "internet-drafts@ietf.org" <internet-drafts@ietf.org>
wrote:

>
>A new version of I-D, draft-vyncke-v6ops-happy-eyeballs-cookie-01.txt
>has been successfully submitted by Eric Vyncke and posted to the
>IETF repository.
>
>Name:		draft-vyncke-v6ops-happy-eyeballs-cookie
>Revision:	01
>Title:		HTTP State Management Mechanisms with Multiple Addresses User
>Agents
>Document date:	2015-03-06
>Group:		Individual Submission
>Pages:		7
>URL:            
>http://www.ietf.org/internet-drafts/draft-vyncke-v6ops-happy-eyeballs-cook
>ie-01.txt
>Status:         
>https://datatracker.ietf.org/doc/draft-vyncke-v6ops-happy-eyeballs-cookie/
>Htmlized:       
>http://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie-01
>Diff:           
>http://www.ietf.org/rfcdiff?url2=draft-vyncke-v6ops-happy-eyeballs-cookie-
>01
>
>Abstract:
>   HTTP servers usually save session states in their persistent storage
>   indexed by session cookies generated by the HTTP servers.  It is up
>   to the HTTP user-agent to send this session cookie on each HTTP
>   request.  Some HTTP servers check whether the cookie is associated
>   with the HTTP user-agent by the means of the user-agent IP address.
>   Everything linking a state to an IP address (such as OAuth access
>   code) to an IP address has the same issue.
>
>   If the Happy Eyeball mechanism is used to select between IPv6 and
>   IPv4, it may happen that while using the same HTTP server, some HTTP
>   requests are done over IPv6 and the others over IPv4, which leads to
>   two different sets of session states in the HTTP server.  This has
>   the consequence of inconsistencies at the HTTP server.
>
>   The only purpose of this document is to document this issue in more
>   details than in section 8.2 of RFC 6883 including security
>   considerations and mitigations.
>
>   A similar problem arises with the use of non RFC 6888 compliant
>   Carrier-Grade NAT (CGN) devices used to access an IPv4-only HTTP
>   server or HTTP user-agent using multi-homing.
>
>                  
>        
>
>
>Please note that it may take a couple of minutes from the time of
>submission
>until the htmlized version and diff are available at tools.ietf.org.
>
>The IETF Secretariat
>

[apps-discuss] FW: New Version Notification for d… Eric Vyncke (evyncke)