Re: [OAUTH-WG] Ignoring unrecognized request parameters

John Bradley <> Sat, 18 February 2012 23:41 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id BA5AA21E800F for <>; Sat, 18 Feb 2012 15:41:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.443
X-Spam-Status: No, score=-3.443 tagged_above=-999 required=5 tests=[AWL=0.155, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id YXkHx2P-zwCp for <>; Sat, 18 Feb 2012 15:41:08 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 93D5F21F8591 for <>; Sat, 18 Feb 2012 15:41:08 -0800 (PST)
Received: by yhkk25 with SMTP id k25so2583686yhk.31 for <>; Sat, 18 Feb 2012 15:41:08 -0800 (PST)
Received-SPF: pass ( domain of designates as permitted sender) client-ip=;
Authentication-Results:; spf=pass ( domain of designates as permitted sender)
Received: from ([]) by with SMTP id s4mr320250anh.8.1329608468240 (num_hops = 1); Sat, 18 Feb 2012 15:41:08 -0800 (PST)
Received: by with SMTP id s4mr243447anh.8.1329608466437; Sat, 18 Feb 2012 15:41:06 -0800 (PST)
Received: from [] ( []) by with ESMTPS id h20sm21287270ang.7.2012. (version=TLSv1/SSLv3 cipher=OTHER); Sat, 18 Feb 2012 15:41:04 -0800 (PST)
Mime-Version: 1.0 (Apple Message framework v1257)
Content-Type: multipart/signed; boundary="Apple-Mail=_91152047-461F-4912-9A67-291EA3B6FDCD"; protocol="application/pkcs7-signature"; micalg="sha1"
From: John Bradley <>
In-Reply-To: <>
Date: Sat, 18 Feb 2012 20:41:01 -0300
Message-Id: <>
References: <>
To: Eran Hammer <>
X-Mailer: Apple Mail (2.1257)
X-Gm-Message-State: ALoCoQkAesydXWWHTEIyj/el0IHzifvjT9+k+acOHw2FaqA1T82F3wpSPtVuBvQzMkN74YMI9By/
Cc: "" <>
Subject: Re: [OAUTH-WG] Ignoring unrecognized request parameters
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 18 Feb 2012 23:41:09 -0000

It is a general problem with security protocols like SOAP, SAML, X.509.

Sometimes when you define an extension you want to be certain that the Authorization server understands it,  or you want an error.

As an example if someone did a authentication context extension (Not proposing it just an example).   They would perhaps rather have an error if the Authorization server did not understand the extension,  they could then retry without the extension if that worked for them.

This is generally dealt with by marking something as mustUnderstand in SOAP or critical in x.509.

Without that functionality (I am not asking to add it) it may be reasonable for some Authorization servers to return an error if they do not completely understand what is being sent to them.

One school of thought feels that anything you don't understand in a message could be an indication of a problem or tampering.   

I am sympathetic to the Forward compatibility argument,  however without some sort of mustUnderstand semantics it is not going to always work.

One thing that might help is an error message to indicate that it is being rejected due to unknown extensions so a client can retry.

John B. 

On 2012-02-16, at 8:01 PM, Eran Hammer wrote:

> Can you give an example where an unknown parameter being ignored can lead to security issues?
> EH
> From: John Bradley <>
> Date: Thu, 16 Feb 2012 11:55:21 -0700
> To: William Mills <>
> Cc: "" <>
> Subject: Re: [OAUTH-WG] Ignoring unrecognized request parameters
> If you have a generic client that works across multiple Authorization endpoints some that have extension X and others not, I can see that having the Authorization servers ignore unknown parameters is desirable.
> However there are some endpoints that are not going to be able to allow unknown parameters due to there security policy.   They are often a indication of an attack.
> If this remains a MUST then some endpoints will have to ignore it, and be non compliant.
> I would be OK with something like "MUST ignore unknown parameters unless the endpoint is required to return an error due to local security policy."
> There is probably no perfect compromise on this one.
> John B.
> On 2012-02-16, at 3:32 PM, William Mills wrote:
>> No, this is required for forward compatibility.  Implementations that send extended parameters like capability advertisements (i.e. CAPTCHA support or something) shoudl not be broken hitting older implementations.
>> From: Mike Jones <>
>> To: "" <> 
>> Sent: Thursday, February 16, 2012 10:16 AM
>> Subject: [OAUTH-WG] Ignoring unrecognized request parameters
>> In core -23, the last paragraph of section 3.1 now says:
>>                 The authorization server MUST ignore unrecognized request parameters.
>> In -22, this said:
>>                 The authorization server SHOULD ignore unrecognized request parameters.
>> In a security protocol, it seems unreasonable to require that information be ignored.  As I see it, it SHOULD be legal to return an error if unrecognized information is received.
>> Why the change?  And can we please have it changed back to SHOULD in -24?
>>                                                                 Thanks,
>>                                                                 -- Mike
>> _______________________________________________
>> OAuth mailing list
>> _______________________________________________
>> OAuth mailing list