Re: [OAUTH-WG] OAuth Bearer authentication - for proxies?

[Igor Faynberg <[e-mail]>]

Well, this exchange made me read all I could find on reverse proxies.  
Now I understand--and agree with--the last statement of AYJ:  '"the 
server" is a proxy. '

But my understanding is that the proxy (which DNS pointed me to when I 
tried to get to my bank) belongs in the domain "mybank," and this proxy 
had been issued a valid certificate--which I had ascertained in the 
process of authentication. So, the end result is that the proxy is part 
of the bank.  If we expect it to be harmful to the bank--so we could the 
"server" itself as well as any bank's employee.  It would be the bank 
replaying things to itself, right?

Then it is the bank's problem, not OAuth's as far as I am concerned...

Igor

On 1/2/2012 7:36 PM, Amos Jeffries wrote:
> On 1/2/2012 7:07 AM, Amos Jeffries wrote:
>>> On 2/01/2012 11:00 p.m., Torsten Lodderstedt wrote:
>>> ...
>>>>
>>>> general note: I do not understand why caching proxies should impose 
>>>> a problem in case TLS is used (end2end). Could you please explain?
>>>
>>> Because TLS is hop-by-hop (in HTTP hops, end-to-end only in TCP 
>>> hops). Proxies which decrypt TLS and provide responses out of cache 
>>> are already deployed in many places. Mostly in the form of 
>>> reverse-proxies, but corporate decryption proxies are also on the 
>>> increase.
>>>
>>> AYJ
>
> On 3/01/2012 11:17 a.m., Igor Faynberg wrote:
>> I am at a loss here; granted, it is a gray area...  Does it mean that 
>> RFC 2817 has not been implemented properly?
>>
>
> From RFC 2817:
> "
>
> 5. Upgrade across Proxies
>
>    As a hop-by-hop header, Upgrade is negotiated between each pair of
>    HTTP counterparties.  If a User Agent sends a request with an Upgrade
>    header to a proxy, it is requesting a change to the protocol between
>    itself and the proxy, not an end-to-end change.
> "
>
> The more common case is CONNECT method from RFC 2068, from a user 
> agent to a reverse-proxy. Same behaviour.
>
>> To make it simple: At the client, I establish a session key with the 
>> server, and then use it for confidentiality.  How is this key known 
>> to any proxy?
>
>  "the server" is a proxy.
>
> AYJ