Re: [apps-discuss] Reserved URI query parameter in draft-ietf-oauth-v2-bearer

[Mike Jones <[e-mail]>]

I don't believe that URI comparison considerations are pertinent here.  Here's why...

These URIs contain a bearer token.  As such, it would be a complete security breach for these URIs to ever become visible to any but the intended parties.  Why?  Per the Security Considerations section, this would allow anyone in possession of them to successfully impersonate the client and perform operations as if they were the client.  (That's the nature of a bearer token.)

Therefore, these URIs MUST never be visible to Web crawlers or any other third parties that might try to use URI comparison rules on them in some generic way.  For security reasons, their use is scoped strictly to the client and the protected resource.

Therefore, URI comparison considerations do not apply.

				-- Mike

-----Original Message-----
From: Dick Hardt [mailto:[e-mail]] 
Sent: Saturday, April 14, 2012 1:25 AM
To: Tim Bray
Cc: Dick Hardt; Ned Freed; Carsten Bormann; Pete Resnick; Apps Discuss; [e-mail]
Subject: Re: [apps-discuss] Reserved URI query parameter in draft-ietf-oauth-v2-bearer

Thanks Tim.

I did not see any discussion on normalizing key=value pairs. One would assume that http://exmaple.com/?a=1&b=2 is equivalent to http://exmaple.com/?b=2&a=1 -- but that does not seem to be significant here.

There are numerous practical reasons for the bearer token to be able to be passed as a query parameter which I would be happy to enumerate if anyone is interested. (so far no one has asked :)

I'm trying to understand the desire to remove this functionality, and after reading the spec my take away is a desire to not specify a query parameter. What am I missing?

-- Dick

On Apr 14, 2012, at 12:58 AM, Tim Bray wrote:
> That would be http://tools.ietf.org/html/rfc3986#section-6
> 
> The fact that it's kind of long, but still doesn't find room for 
> reserved ?key=val pairs, is significant in this context. -T
> 
> On Sat, Apr 14, 2012 at 12:43 AM, Dick Hardt <[e-mail]> wrote:
>> 
>> On Apr 13, 2012, at 10:58 PM, Ned Freed wrote:
>> 
>> 
>> That said, the rules are what they are, and comparison of URIs has to 
>> be taken into account.
>> 
>> 
>> What is the URI comparison rule you are referring to?
>> 
>> -- Dick