Re: [OAUTH-WG] Artart last call partial review of draft-ietf-oauth-iss-auth-resp-02

Karsten Meyer zu Selhausen <karsten.meyerzuselhausen@hackmanit.de> Mon, 15 November 2021 14:59 UTC

Message-ID: <7c515322-b19f-a1a6-e36a-100ff8d8ef58@hackmanit.de>
Date: Mon, 15 Nov 2021 15:58:53 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.3.0
Content-Language: en-US
To: Julian Reschke <julian.reschke@gmx.de>, art@ietf.org
Cc: draft-ietf-oauth-iss-auth-resp.all@ietf.org, last-call@ietf.org, oauth@ietf.org
References: <163576279118.23946.14747101192871915313@ietfa.amsl.com>
From: Karsten Meyer zu Selhausen <karsten.meyerzuselhausen@hackmanit.de>
In-Reply-To: <163576279118.23946.14747101192871915313@ietfa.amsl.com>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="------------XJnnrqGiOOgNZpSnXjtJMsMq"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/-E3uAeOOlV1AEebKoawnHf4JDhg>
Subject: Re: [OAUTH-WG] Artart last call partial review of draft-ietf-oauth-iss-auth-resp-02
Precedence: list

Hi Julian,

thank you for your comments. Answers inline

We mostly addressed them locally and will publish a new version when all 
IESG reviews are available and addressed by us.

Best regards,
Karsten

On 01.11.2021 11:33, Julian Reschke via Datatracker wrote:
> Review is partially done. Another assignment may be needed to complete it.
>
> Reviewer: Julian Reschke
> Review result: Almost Ready
>
> (I have reviewed this with zero knowledge of OAuth, so additional review
> probably would be good)
>
> Major issues:
>
> 2.4
>
> "Clients MUST compare the extracted and URL-decoded value to the issuer
> identifier of the authorization server where the authorization request was sent
> to."
>
> I'm not sure that "URL-decoded" is correct with respect to decoding query
> parameters. Consider URLs containing "+" or "=". You probably need the encoding
> rules for application/x-www-form-urlencoded instead.
Good point. We changed the text to refer to 
application/x-www-form-urlencoded.
>
> Minor issues:
>
> References to registries should not be listed as normative.
+1 that was an editorial mistake. Fixed.
>
> Nits:
>
> Section links to external documents do not appear to be marked up as such (and
> use a trailing dot in the section number which they should not)
I am acutally not sure how to fix this. I removed the trailing dot 
(thanks for the hint) but when converting markdown to XML the section is 
not automatically recognized.
My markdown looks like this:
The authorization response as specified in Section 4.1.2 of [@!RFC6749]

The XML file like this:
The authorization response as specified in Section 4.1.2 of <xref 
target="RFC6749"></xref>

Is there some example how to link the sections in external RFCs or 
should we create the links manually?

>
> There are no Acks; so section 6 should be deleted (if there were acksm they
> should go into an unnumbered section at the end of the document)
We added missing Acks and moved them to the appendix.
>
>
>
-- 
Karsten Meyer zu Selhausen
Senior IT Security Consultant
Phone:	+49 (0)234 / 54456499
Web:	https://hackmanit.de  | IT Security Consulting, Penetration Testing, Security Training

Is your OAuth or OpenID Connect application vulnerable to mix-up attacks? Find out more on our blog:
https://www.hackmanit.de/en/blog-en/132-how-to-protect-your-oauth-client-against-mix-up-attacks

Hackmanit GmbH
Universitätsstraße 60 (Exzenterhaus)
44789 Bochum

Registergericht: Amtsgericht Bochum, HRB 14896
Geschäftsführer: Prof. Dr. Jörg Schwenk, Prof. Dr. Juraj Somorovsky, Dr. Christian Mainka, Prof. Dr. Marcus Niemietz

Attachment: OpenPGP_signature

[OAUTH-WG] Artart last call partial review of dra… Julian Reschke via Datatracker
Re: [OAUTH-WG] Artart last call partial review of… Karsten Meyer zu Selhausen

Re: [OAUTH-WG] Artart last call partial review of draft-ietf-oauth-iss-auth-resp-02

Attachment: OpenPGP_signature