Re: [OAUTH-WG] client certs and TLS Terminating Reverse Proxies (was Re: I-D Action: draft-ietf-oauth-jwt-introspection-response-08.txt)

Neil Madden <> Wed, 30 October 2019 14:30 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 993E9120108 for <>; Wed, 30 Oct 2019 07:30:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 7_pdtMA2eB7e for <>; Wed, 30 Oct 2019 07:30:48 -0700 (PDT)
Received: from ( [IPv6:2a00:1450:4864:20::435]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 865091208EA for <>; Wed, 30 Oct 2019 07:30:48 -0700 (PDT)
Received: by with SMTP id v9so2554177wrq.5 for <>; Wed, 30 Oct 2019 07:30:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=tRHEaJ63MjMW0dy6pd/R7WikLOwqR0KpYT9maVd5aT8=; b=bbftEINNle9pMin+ErLszmvMa4yvLV1JzZqkFVi670lpqQBJuebFOl71dFt6lxbPws +dIkTzjl+Wgwv2V/ZV8uYjFvqJPjv930PRF49YIhx1L2EWoy2Bcj31nO5anjjSHgTWIK /bXC9D2NW4NOfyuOJYhxCGARjUVQ5zWPg97kY=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=tRHEaJ63MjMW0dy6pd/R7WikLOwqR0KpYT9maVd5aT8=; b=ICtmll7sW9pBegvhZT1elVMKU00ddc8kWx6spVy5gYP7s9fDaVnbVcHIQWryl+CAVn UHE8d2v6Kuea/qjSMf87o1/NxoyumpqVz0HLBd6GGrAqyBhLQEAzx+mdd+HvoFbhs3+R DNADBS/YaHYN6qqaXm55YA4nqCmVtDUDCsRfr9vWKZ5U0thyyiYQ2eFVEUJES1OWMeMi hjTOfD69e3aFQ92E4LnlLXepOAAAjFzj4JkcPs51jgCWw4OsGtqUHUWuAyB0dJKh35ld 4sExnhwhE6zF0zO6xWqAixLAkfcNtfYCMFCwbgSQCKUqtYH1FzUBgA60wKscTIo2aYvw 6B+A==
X-Gm-Message-State: APjAAAW0VqhIB0ZgWLibXtlrY22/3wkKdds+A6ulYuIrpPAr2Xhg0byL hx1nb92Imab57PkmXzojwe/dqw==
X-Google-Smtp-Source: APXvYqxv7tBHaK1gNT9/xsP5fCs2v3FkFwihtPaK9rZBwEGkEU7Oqyd9+EbbMkMfT0xd4aBO+kqGFg==
X-Received: by 2002:a5d:674f:: with SMTP id l15mr181515wrw.80.1572445846916; Wed, 30 Oct 2019 07:30:46 -0700 (PDT)
Received: from [] ( []) by with ESMTPSA id m3sm407378wrb.67.2019. (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 30 Oct 2019 07:30:46 -0700 (PDT)
From: Neil Madden <>
Message-Id: <>
Content-Type: multipart/alternative; boundary="Apple-Mail=_D8EA28FE-15F5-4D14-B97E-779C7074B10D"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Date: Wed, 30 Oct 2019 14:30:45 +0000
In-Reply-To: <>
Cc: Justin Richer <>, Brian Campbell <>, oauth <>
To: "Salz, Rich" <>
References: <> <> <> <> <>
X-Mailer: Apple Mail (2.3445.104.11)
Archived-At: <>
Subject: Re: [OAUTH-WG] client certs and TLS Terminating Reverse Proxies (was Re: I-D Action: draft-ietf-oauth-jwt-introspection-response-08.txt)
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 30 Oct 2019 14:30:52 -0000

Combining responses to related messages (429 error):

On 30 Oct 2019, at 14:07, Salz, Rich <> wrote:
>> But an unguessable header name is *simple* and effective and works right now with widely implemented functionality. 
> You mean like admin/admin for administrator access?  There is no such thing as an unguessable name.

I'm thinking of a uniformly random 16 byte name right now. Have at it.

> You claim the name will never be exposed to untrusted parties.  How so?  You are now telling administrators to treat a *name* as securely as they treat a *key* (or password).  If it must be protected like key material, then use it like key material.

Again, this is a defense in depth measure. A config file is fine.

> The proxy-backend should be TLS, ideally authenticating the proxy.

I agree - but completely irrelevant to the current discussion, which is about how the backend distinguishes security-critical headers that the proxy set from security-critical headers that were sneaked past the proxy by a client (through misconfiguration or parsing bug).

> On 30 Oct 2019, at 14:18, Salz, Rich <> wrote:
> Again, authenticating the *connection* from the RP to the backend services is good, but is completely orthogonal to authenticating the headers themselves.
> I strongly disagree.  Authenticating the sender allows the receiver to make a trust decision in the provenance and quality of the data it gets from the sender.  Do you disagree with that?

Yes, see: <> <> <>

and so on and so on. Authenticating the other side of a communication pipe is not sufficient to authenticate the origin of the data contained within those messages. The whole point of a proxy is that it forwards requests from clients. In the face of misconfigurations and parsing bugs the backend cannot distinguish headers that were set by the proxy from headers that were spoofed by the client. *This is the entire problem I have been discussing*. 

-- Neil