IETF Logo Mail Archive

Re: [OAUTH-WG] OAuth v2-18 comment on "state" parameter

Bob Van Zant <bob@veznat.com> Wed, 20 July 2011 18:28 UTC

Return-Path: <bigbadbob0@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5806821F8B08 for <oauth@ietfa.amsl.com>; Wed, 20 Jul 2011 11:28:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.896
X-Spam-Level:
X-Spam-Status: No, score=-2.896 tagged_above=-999 required=5 tests=[AWL=0.081, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y6wh2r7uj+Ad for <oauth@ietfa.amsl.com>; Wed, 20 Jul 2011 11:28:10 -0700 (PDT)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by ietfa.amsl.com (Postfix) with ESMTP id C0B2B21F8AF0 for <oauth@ietf.org>; Wed, 20 Jul 2011 11:28:10 -0700 (PDT)
Received: by qyk9 with SMTP id 9so3693790qyk.10 for <oauth@ietf.org>; Wed, 20 Jul 2011 11:28:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=H/EHQoQxRcSr39UIN7N/IK3DIG73YGqwfmT9atnalEA=; b=oecqkeg7Kjd5FQn+4IMk/jVYSPSUWj+esI8CCI+3pihJ14oS1kDxFCS/sWRog4nFC6 Ef7OEwta1BloAkhVAHpRikGXY/uOxfzHO5vIQENzL0OycnWP8zESZu/UpHtfFcoA8lxi CacplgZ4d+Tzs5yYMy5QqF1LF8S1tsaz77VI0=
MIME-Version: 1.0
Received: by 10.229.44.197 with SMTP id b5mr7267855qcf.117.1311186490202; Wed, 20 Jul 2011 11:28:10 -0700 (PDT)
Sender: bigbadbob0@gmail.com
Received: by 10.229.100.136 with HTTP; Wed, 20 Jul 2011 11:28:10 -0700 (PDT)
In-Reply-To: <90C41DD21FB7C64BB94121FBBC2E72345020652CE2@P3PW5EX1MB01.EX1.SECURESERVER.NET>
References: <CADrOfLJSd8Z=QfCcGUdFBU314rmjv9-u25Vta+ObXfNAwoA06w@mail.gmail.com> <4E22B021.7080009@cisco.com> <90C41DD21FB7C64BB94121FBBC2E7234501D6E0656@P3PW5EX1MB01.EX1.SECURESERVER.NET> <CAGHdeD711qcuZiJ6C8miMNfTW1iDTvqG1KKrEZrWsM2Mxxs3WA@mail.gmail.com> <CADrOfLJd7jtfJGBwxaX1bQHN-Ow=T-kGLTgOWw0rR1cYGCpzog@mail.gmail.com> <90C41DD21FB7C64BB94121FBBC2E72345020652CA4@P3PW5EX1MB01.EX1.SECURESERVER.NET> <CADrOfLJLe_JdGZTWdSGLvXySbh==3oNuYJHQRPWL+RsN9b6AAA@mail.gmail.com> <90C41DD21FB7C64BB94121FBBC2E72345020652CE2@P3PW5EX1MB01.EX1.SECURESERVER.NET>
Date: Wed, 20 Jul 2011 11:28:10 -0700
X-Google-Sender-Auth: D1icX4CfrpKczdcbsMuUSAY6mlI
Message-ID: <CADrOfLJszVuxP9Eiz_MjABhUghF07Rie05Pysc1PF--KZKUcGw@mail.gmail.com>
From: Bob Van Zant <bob@veznat.com>
To: Eran Hammer-Lahav <eran@hueniverse.com>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] OAuth v2-18 comment on "state" parameter
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 20 Jul 2011 18:28:11 -0000

> In short, over specification does not solve ignorance. We can and should highlight the possible code injection attacks on both the client and authorization server, as well as other security concerns around the state parameter. But at the end, it is up to both the client and authorization server developers to build secure applications.
>
> So, anyone volunteering to propose text?

I'll give it a shot.

v2.46.0 | Report a Bug | By Email | System Status