Re: [OAUTH-WG] draft-parecki-oauth-browser-based-apps-00

Brian Campbell <bcampbell@pingidentity.com> Sat, 17 November 2018 22:08 UTC

Return-Path: <bcampbell@pingidentity.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D04F912F1A2 for <oauth@ietfa.amsl.com>; Sat, 17 Nov 2018 14:08:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jikANPr67xcs for <oauth@ietfa.amsl.com>; Sat, 17 Nov 2018 14:08:31 -0800 (PST)
Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE58B1294D7 for <oauth@ietf.org>; Sat, 17 Nov 2018 14:08:30 -0800 (PST)
Received: by mail-io1-xd31.google.com with SMTP id j18-v6so7628420iog.6 for <oauth@ietf.org>; Sat, 17 Nov 2018 14:08:30 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=D2qF0vB97sXYYjKWO6DlrXHJOtESklIH0L8NBIkiBVc=; b=osodrG8fGXCWr4jqANY6jSHLHgCqf2k/wIlK51OL5WPw6thFCHNIuwaVC99Rhq6Uma WiGCG6/Qqubda5YBl/KnMTAGDerEKKCDmkO08egkWlJLUEgieYhWEF8Y0ESt1KQoSGDa XAl6N7JFJl9474QGSjiIbNRobaCGBVSuVGouY=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=D2qF0vB97sXYYjKWO6DlrXHJOtESklIH0L8NBIkiBVc=; b=Z+xU6SqItE631zNEgIZafnrBKpaFcW9DQajTwhr2LHWvzfNC0/1SlTz9jzC5QIK6qG kJCSYoIkG3G0UuDtFb0YZxL/Lz+XiDSF64c1gxljBxFxQrRhHfO0A5JqwfpRCDMbE6Hu AB7pJa78V6DmIRFrVtpbzipnf4mIk1+cj3S1AmyMizzodsASFd3MIWuniKTFCYtnVBlU +BUxCYySrSkHa8ydyn7UxJKzweL+pOh6yMgKzEoJXfmpCT2DwqDoLWWUboGb6krYsEfi W1h8ehHFYgROr7tCEc8vz1zmXjGY/oOPIw+YulmEEeC5CtIVzgKstySfY54P6XjCmSqw HSjQ==
X-Gm-Message-State: AA+aEWbOO8YQrN0/lb5QZ6pWU4i7dNJX+qz4UKx8o68vLUvj3KvoNMfr owhtZ7vlyHIUEA+pI4tDWiX4bgAq94L3mYLTlIAIQZk6nhT1AoorC3vFE/yNiXe4P7OHWU/1bSF 8EYRmUhThOVanhg==
X-Google-Smtp-Source: AJdET5csJ452tXw3+YqhWnJ64htR75atlMNBR7fTYl20OaCnLR1hp1wwmho9zOXlYBAGEY4Ujwl/uzBsz3evKBNdFkI=
X-Received: by 2002:a6b:b345:: with SMTP id c66mr13122031iof.59.1542492510006; Sat, 17 Nov 2018 14:08:30 -0800 (PST)
MIME-Version: 1.0
References: <VI1PR0801MB211299BED6B61582DC33B873FACB0@VI1PR0801MB2112.eurprd08.prod.outlook.com> <CAGBSGjqHKVveZor-oKUWzsQ0Rg5Fk_d2dns_eQFqfvXJynyQaQ@mail.gmail.com> <9347fff8-f3b9-4ee9-84d3-5eebc8dd13f4@getmailbird.com> <309DAA7D-E9B9-4A89-B30E-5BE37DC6CC85@lodderstedt.net> <27627bee-aaab-44fd-9821-b58f7b33bc13@getmailbird.com> <7A852312-B129-4A0F-9914-8DC7E63FD12C@lodderstedt.net> <64a7f649-d2d8-4983-a564-5193adb4314a@getmailbird.com> <5B60008C-C6A7-44CC-B045-9A8C1248ED30@lodderstedt.net>
In-Reply-To: <5B60008C-C6A7-44CC-B045-9A8C1248ED30@lodderstedt.net>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Sat, 17 Nov 2018 15:08:18 -0700
Message-ID: <CA+k3eCR+JHJhDAP_Trx4StvtfxjSyeiaGLFki93OFP6Jw5NT+g@mail.gmail.com>
To: Torsten Lodderstedt <torsten@lodderstedt.net>
Cc: Brock Allen <brockallen@gmail.com>, oauth <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000020c098057ae38672"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/DQL0LX0TFhbTXMz8v8EfUrxemvs>
Subject: Re: [OAUTH-WG] draft-parecki-oauth-browser-based-apps-00
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 17 Nov 2018 22:08:33 -0000

I might suggest that neither of those are really best current practice per
se. Using key constrained tokens is more of an aspirational recommendation
for what would be good security practice than it is something that's done
much for real in practice today.

On Sat, Nov 17, 2018, 4:07 AM Torsten Lodderstedt <torsten@lodderstedt.net
wrote:

>
> > Am 15.11.2018 um 23:01 schrieb Brock Allen <brockallen@gmail.com>:
> >
> > So you mean at the resource server ensuring the token was really issued
> to the client? Isn't that an inherent limitation of all bearer tokens
> (modulo HTTP token binding, which is still some time off)?
>
> Sure. That’s why the Security BCP recommends use of TLS-based methods for
> sender constraining access tokens (
> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-09#section-2..2)
> Token Binding for OAuth (
> https://tools.ietf.org/html/draft-ietf-oauth-token-binding-08) as well as
> Mutual TLS for OAuth (https://tools.ietf.org/html/draft-ietf-oauth-mtls-12)
> are the options available.
>
>
>
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._