Re: [OAUTH-WG] Call for Adoption: OAuth 2.0 Mix-Up Mitigation

Josh Mandel <> Thu, 21 January 2016 14:04 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id CE3811A87D9 for <>; Thu, 21 Jan 2016 06:04:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id aY8LhJzkjigE for <>; Thu, 21 Jan 2016 06:04:11 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:4002:c07::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 4DC9F1A87D7 for <>; Thu, 21 Jan 2016 06:04:11 -0800 (PST)
Received: by with SMTP id k129so49093532yke.0 for <>; Thu, 21 Jan 2016 06:04:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=kfa/4330G8m/isQAAlLhi19K0fXqNTDOwj8lHBbDSk4=; b=jPpjon2T4hhgzl6Qh0ZVaPkgL9rvrC5z/boP/XnV5+0TZq1+tZCkeMfn8wWZDP6fBQ CJuuTE78kh+F0tO0FXvcXtUQPxCDi/6MErv2O/edKmO2P4ez6terLJ2JbFidt/pdE7IZ fniiQqwcIlpaNcY/rlyw67MKEEqnibJnpnqHFic2x+XBTMlIIBJEi7hQ7v9OkpH9Pqe2 4Y8PoL+6LBP0ur0dzuBdjlm29HyUh8zhUgBpkLdEeCjUfOkGAMDbxSA/Aj93BYo5QKR1 Afotp7bZLNCdP/BDRPJAvkCy1jlWfvhufepTGjlJI5MzBey1RO+/r/jPdwQJjg7k0Nof ROWQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=kfa/4330G8m/isQAAlLhi19K0fXqNTDOwj8lHBbDSk4=; b=OkK8Ca7iu2DtJxAO2/NMvxFvQs8ZUU7/2l/zRJ9L9n2rffrLvmhadI8XT+t6eEfwKh bC1y5fizQq4yZp/X8krkBxFGEgY63XWSV5WyAxQ98z/OOtZOPCL6861YDdFHa7CzoMZD MFP3P7Wzev9zuhauOPOPV3wH2aHFuXkKutU2P0eEePRqKElsSeDYoqJF5qWbkwBwujjW LfaNSuUfS6hzIr9ZHA7CjBRd2ZCAjcBFZlMkLGYPp8aNoSXYRFA/D87KoOtBDfZWtqsX A8IdP1KV+6FO8Mb2mgY8ugJohhlowiEQt2I3YD0jcvF9MtUds2V9aPE5J/HilYDpt361 yMcA==
X-Gm-Message-State: ALoCoQnnFrFnxUqhPd3EG2bOjoPgUoq68I1FqgjvesKx+LLavqqBHG7TrcHpZ4gogarcLzLRhNc+9K3PjJNM0egv4TqzBBYNuw==
MIME-Version: 1.0
X-Received: by with SMTP id g8mr14085792ybb.91.1453385050536; Thu, 21 Jan 2016 06:04:10 -0800 (PST)
Received: by with HTTP; Thu, 21 Jan 2016 06:04:10 -0800 (PST)
Received: by with HTTP; Thu, 21 Jan 2016 06:04:10 -0800 (PST)
In-Reply-To: <>
References: <>
Date: Thu, 21 Jan 2016 09:04:10 -0500
Message-ID: <>
From: Josh Mandel <>
To: Hannes Tschofenig <>
Content-Type: multipart/alternative; boundary="001a11c157daa8c46c0529d893e4"
Archived-At: <>
Cc: " WG" <>
Subject: Re: [OAUTH-WG] Call for Adoption: OAuth 2.0 Mix-Up Mitigation
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 21 Jan 2016 14:04:14 -0000

Apologies if this is the wrong forum for my comment (and please direct me
to the appropriate place in that case), but I have two questions about the
propose mitigation (and the thinking behind it) that I think the write-up
could address:

1. Could the writeup clarify whether/how the primary "mixup" threat differs
from what RFC6819 identifies as in section 4.6.4?

2. Has the workgroup considered a mitigation that puts more responsibility
on the authorization server, and less on the client? For example, if would
be helpful for the writeup to clarify why having the client send an
"audience field" (in the terminology of RFC6819) to the authorization
endpoint would not mitigate the threat. (In that scenario, the
authorization server can recognize that the audience does not correspond to
a resource server it knows, rather than asking clients to make this check).
I assume this approach has been considered and rejected as an incomplete
mitigation, but I don't have visibility into where/how that discussion


Hi all,

this is the call for adoption of OAuth 2.0 Mix-Up Mitigation, see

Please let us know by Feb 9th whether you accept / object to the
adoption of this document as a starting point for work in the OAuth
working group.

Note: This call is related to the announcement made on the list earlier
this month, see More
time for analysis is provided due to the complexity of the topic.

Hannes & Derek

OAuth mailing list