Re: [kitten] AD review of draft-ietf-kitten-sasl-oauth-21

[Stephen Farrell <[e-mail]>]

On 29/04/15 20:43, Benjamin Kaduk wrote:
> The server fully validates the client response before generating a server
> response; this will necessarily include the validation steps listed in the
> specification for the OAuth Access Token Type used.  However, additional
> validation steps may be needed, depending on the particular application
> protocol making use of SASL.  In particular, values included as kvpairs in
> the client response (such as host and port) which correspond to values
> known to the application by some other mechanism (such as an application
> protocol data unit or pre-configured values) MUST be validated to match
> between the initial client response and the the other source(s) of such
> information.  As a concrete example, when SASL is used over TLS, the
> hostname can be available via the Server Name Indication TLS extension;
> this hostname must be validated to match the value sent in the 'host'

Yep, that'd work I think.

S.