Re: [core] Questions and comments against the github version

[Christian Amsüss <[e-mail]>]

Hello Lauri,

On Wed, Dec 12, 2018 at 09:55:58AM +0000, Lauri Piikivi wrote:
> If a EP publishes itself in rd, no other ep, based on adequate
> authenticaiton, can overwrite it. If an earlier registered EP makes a
> new registration to the RD, where it does not include the location in
> the path, is an indication that the EP may have reset or otherwise
> wants a new registration (e.g. Due to changed attributes) in the rd.

Yes.

> Another ep trying to post to another ep’s url should get an error.
> This requires authenticaiton.

An new ep trying to post to an old ep's registration URL is what I'd
call "registration hijacking". It is not allowed, but begs the question
of how the RD would know that the hijacking endpoint is actually
different from the original one.

If the credentials are suitable, the only assumption the RD can make is
that the "new" endpoint is the same as the old one, and that it has only
just switched its network address.

Otherwise, the RD would reject the operation with 4.01 Unauthorized.

Best regards
Christian

-- 
The detailed semantics of CoAP methods are "almost, but not entirely
unlike" [HHGTTG] those of HTTP methods.
[HHGTTG]: Adams, D., "The Hitchhiker's Guide to the Galaxy", October 1979.
  -- Shelby, et al., Internet-Draft Constrained Application Protocol (CoAP)