[OAUTH-WG] Fwd: New Version Notification for draft-ietf-oauth-security-topics-23.txt

Daniel Fett <mail@danielfett.de> Tue, 06 June 2023 06:46 UTC

Content-Type: multipart/alternative; boundary="------------4hjkABSEivIIQLPJP3ZsAXZI"
Message-ID: <8271bbc9-b571-7f21-fddc-3a4e694a6bc6@danielfett.de>
Date: Tue, 06 Jun 2023 08:46:21 +0200
MIME-Version: 1.0
References: <168603324657.34280.5588205604665416330@ietfa.amsl.com>
Content-Language: de-DE
From: Daniel Fett <mail@danielfett.de>
To: oauth@ietf.org, oauth-chairs@ietf.org
In-Reply-To: <168603324657.34280.5588205604665416330@ietfa.amsl.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/cW6cPuNhSQ6tk4dJ9_u3OLOU8BU>
Subject: [OAUTH-WG] Fwd: New Version Notification for draft-ietf-oauth-security-topics-23.txt
Precedence: list

Hi all,

for this new version of the Security BCP, we added what we understood 
was the minimal consensus from the discussion on the usage of CORS here 
on this mailing list (see 
https://mailarchive.ietf.org/arch/msg/oauth/7Uv00hN8StKczOtNmFA0KvteFTw/).

We further aligned Section 4.15.1 with OAuth 2.1 to account for cases 
where client_ids are created by clients themselves.

On the non-normative side of things, we also updated references (e.g., 
RAR), fixed some typos and mistakes, clarified things (e.g., to ensure 
that the precise redirect URIs check is unambiguous), and I updated my 
affiliation.

@Hannes, Rifaat: Please start the Shepherd's Writeup on this version.

-Daniel



-------- Weitergeleitete Nachricht --------
Betreff: 	New Version Notification for 
draft-ietf-oauth-security-topics-23.txt
Datum: 	Mon, 05 Jun 2023 23:34:06 -0700
Von: 	internet-drafts@ietf.org
An: 	Andrey Labunets <isciurus@gmail.com>, Daniel Fett 
<mail@danielfett.de>, John Bradley <ve7jtb@ve7jtb.com>, Torsten 
Lodderstedt <torsten@lodderstedt.net>




A new version of I-D, draft-ietf-oauth-security-topics-23.txt
has been successfully submitted by Torsten Lodderstedt and posted to the
IETF repository.

Name: draft-ietf-oauth-security-topics
Revision: 23
Title: OAuth 2.0 Security Best Current Practice
Document date: 2023-06-05
Group: oauth
Pages: 62
URL: https://www.ietf.org/archive/id/draft-ietf-oauth-security-topics-23.txt
Status: https://datatracker.ietf.org/doc/draft-ietf-oauth-security-topics/
Html: 
https://www.ietf.org/archive/id/draft-ietf-oauth-security-topics-23.html
Htmlized: 
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics
Diff: 
https://author-tools.ietf.org/iddiff?url2=draft-ietf-oauth-security-topics-23

Abstract:
This document describes best current security practice for OAuth 2.0.
It updates and extends the OAuth 2.0 Security Threat Model to
incorporate practical experiences gathered since OAuth 2.0 was
published and covers new threats relevant due to the broader
application of OAuth 2.0.



The IETF Secretariat

[OAUTH-WG] Fwd: New Version Notification for draf… Daniel Fett
Re: [OAUTH-WG] Fwd: New Version Notification for … Denis