[httpapi] Re: HTTP->HTTPS redirects bad for API traffic?

[Martin Thomson <[e-mail]>]

Thanks for doing this Mike.

I opened https://github.com/richsalz/draft-rsalz-httpapi-privacy/issues/7 because I think that this business has a much simpler solution.  That issue looks at clients, but the problem is uniform.

The IETF can make a stronger recommendation here and it should.

On Thu, Aug 29, 2024, at 05:07, Mike Bishop wrote:
> As promised, a first pass of our draft is posted as 
> https://www.ietf.org/archive/id/draft-rsalz-httpapi-privacy-00.html. 
> The GitHub repo is at 
> https://github.com/richsalz/draft-rsalz-httpapi-privacy.
> 
> Rather than simply “don’t redirect,” the draft has evolved into a set 
> of recommendations for servers which are expecting credentialed 
> requests. Not all of them will be feasible for every server, and that’s 
> okay – it aims to discuss some strategies that can be used to reduce 
> the risk of credential disclosure.
> 
> I note there was some discussion about which error code to use; that’s 
> currently not addressed, but might be in scope and is the topic of 
> https://github.com/richsalz/draft-rsalz-httpapi-privacy/issues/3.
> 
> *From:* Salz, Rich <[e-mail]> 
> *Sent:* Tuesday, June 4, 2024 10:32 AM
> *To:* Lucas Pardue <[e-mail]>; Mike Bishop 
> <[e-mail]>; Salz, Rich <rsalz=[e-mail]>; 
> [e-mail]
> *Cc:* Rifaat Shekh-Yusef <[e-mail]>
> *Subject:* Re: [httpapi] Re: HTTP->HTTPS redirects bad for API traffic?
> 
> I think, for the API case, there’s a header field or parameter that has 
> an API key.  That should probably be revoked if a request is sent via 
> plaintext.  Browsers put up a warning if you’re about to send a 
> password via HTTP.
> 
> Mike and I are going to draft something in this area, let me/us know if 
> you want to participate (but we will submit to this WG for adoption).
> -- 
> httpapi mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]