Re: [kitten] AD review of draft-ietf-kitten-sasl-oauth-21

[Stephen Farrell <[e-mail]>]

On 28/04/15 16:48, Bill Mills wrote:
> Again I disagree, this is *exactly* the same problem the HTTP host
> header solves.  

The Host header field solves that problem for HTTP, but creates a
problem for an authorization subsystem - if one piece of server
side code checks an action the client wants to do vs. the Host
header field and another makes that check vs. the new field that
we're defining here then that opens a hole. And that error has
been seen many times, so I don't believe you can just do a plug
and play thing here safely, in general.

> IMAP does not have anything that conveys hostname.
> Port number might be known but hostname is not guaranteed. Added "The
> server SHOULD validate that the host and port values match the
> expected values for the service." to the end of the paragraph
> discussing signature base strings where host and port are defined in
> 3.

I've no problem if you add the above but what I'm asking for is
more like: "The server MUST validate that the host and port values
defined here match any other application protocol data units or
configured values that carry the same information. The details of
how to do that match are application-specific and so cannot defined
here, but implementers integrating these SASL mechanisms with
applications need to ensure that such checks are made, where they
are needed."

Cheers,
S.