[OAUTH-WG] Re: I-D Action: draft-ietf-oauth-browser-based-apps-19.txt
Aaron Parecki <aaron@parecki.com> Sun, 20 October 2024 21:32 UTC
Return-Path: <aaron@parecki.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B43A4C16941E for <oauth@ietfa.amsl.com>; Sun, 20 Oct 2024 14:32:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.106
X-Spam-Level:
X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=parecki.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rKD_IITKwwey for <oauth@ietfa.amsl.com>; Sun, 20 Oct 2024 14:32:23 -0700 (PDT)
Received: from mail-vs1-xe31.google.com (mail-vs1-xe31.google.com [IPv6:2607:f8b0:4864:20::e31]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 966E3C14F6F4 for <oauth@ietf.org>; Sun, 20 Oct 2024 14:32:23 -0700 (PDT)
Received: by mail-vs1-xe31.google.com with SMTP id ada2fe7eead31-4a47d70cd8aso1071478137.1 for <oauth@ietf.org>; Sun, 20 Oct 2024 14:32:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=parecki.com; s=google; t=1729459942; x=1730064742; darn=ietf.org; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=Aov2Xm3sl4RXRfc5Ks39jpihbCNM+FZRfGia/Biuq8I=; b=EEBSOicCH3en5MnQB32rLd+Erza+T4EFAawPE3qWUrozYV5ScbluPcNEO1YxOzB91r MUGJpx0S2ji77/3OITZZYSUHk4X5T21xFqZlOD9AVtIQDPPtu9aDvhoWp14NQ1+UYHDu W81jq9+M4OM3mSr1/aJf8OxV/X334F06HvocA8rwbeAJUNNUnoLPrjGdSz1rY7PUA7XR //A9frJUHQ3qbBHqwaLOdkilOCItI3kdcHuQmNYofhhMiWse5frWkHwSxUp4Rq8BnSnx ygfw440CAxnKkGojauuqy2GKe5mgnWGja2HDN92uSJzACz24OQK2MRyFOn/ax2HuMKFW orBg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1729459942; x=1730064742; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=Aov2Xm3sl4RXRfc5Ks39jpihbCNM+FZRfGia/Biuq8I=; b=YERcuHFheZLplSQlZzsNpzoO9ULH4pAif/h5GytW5JZ0ra+rOgT20kAjd7crz8SKIw TRNg1mhx2ndSoxqeRs/yajZGIjxACf5wrYBMZTMbtzHhRBYlgmrLEq6KamA8TWpBRM3G r46m3eubrZ5JZDzO2eBlnNqWpcLs74Zg5/ojqYUeNpvcw6tMHvY/8AV59BvXUxKbOt+L sJ++9duRo56Vc//fiVOSa5/tzAwW0/rp4GKpAv8+/uwi1LZTz/xf+espnO5rsn3fgZ5h uVphFONzh/gjPJ7+gWKbhhbzMvcEZepWiguYNzJkBYNaksY7sU/jG1Rbcdcl1g8Kdx1F AtfA==
X-Gm-Message-State: AOJu0YzPvEXOKhxnmoN/40ZYLFInIKP8JJ7tOmsPMMYAaJjGYFgMcY/m 6s3mbQm21X5YNqjQ3QdZC4JveOvQOE4hQHqK+kc8Ntn4lRely1odrekE1wU8HKT8hex2xYBV2Ds =
X-Google-Smtp-Source: AGHT+IHvOgsC6xZIwa0ekkmpsMytPiBftVjFJXLGNCTJN9jgDCfa5Dq1IXtbjV1QHO8cJL+eiONwKQ==
X-Received: by 2002:a05:6102:2914:b0:4a3:fc62:3ea8 with SMTP id ada2fe7eead31-4a5d6a91e9fmr8382305137.3.1729459942291; Sun, 20 Oct 2024 14:32:22 -0700 (PDT)
Received: from mail-ua1-f42.google.com (mail-ua1-f42.google.com. [209.85.222.42]) by smtp.gmail.com with ESMTPSA id a1e0cc1a2514c-852144dca31sm311859241.5.2024.10.20.14.32.21 for <oauth@ietf.org> (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 20 Oct 2024 14:32:21 -0700 (PDT)
Received: by mail-ua1-f42.google.com with SMTP id a1e0cc1a2514c-84fcd9f4e98so976531241.0 for <oauth@ietf.org>; Sun, 20 Oct 2024 14:32:21 -0700 (PDT)
X-Received: by 2002:a05:6102:511f:b0:4a3:a31c:4056 with SMTP id ada2fe7eead31-4a5d6bb5340mr7359058137.21.1729459940516; Sun, 20 Oct 2024 14:32:20 -0700 (PDT)
MIME-Version: 1.0
References: <172945826659.1831908.3127349618974218415@dt-datatracker-78dc5ccf94-w8wgc>
In-Reply-To: <172945826659.1831908.3127349618974218415@dt-datatracker-78dc5ccf94-w8wgc>
From: Aaron Parecki <aaron@parecki.com>
Date: Sun, 20 Oct 2024 16:32:09 -0500
X-Gmail-Original-Message-ID: <CAGBSGjoTjrnRFpwvbo0pB5sNBbWsBzZyosMpF5g4BmwoC-o1+g@mail.gmail.com>
Message-ID: <CAGBSGjoTjrnRFpwvbo0pB5sNBbWsBzZyosMpF5g4BmwoC-o1+g@mail.gmail.com>
To: oauth@ietf.org
Content-Type: multipart/alternative; boundary="00000000000068765b0624ef4540"
Message-ID-Hash: WNPBXASQ7DXIJVGDJ6JDWM2JNA2G43PA
X-Message-ID-Hash: WNPBXASQ7DXIJVGDJ6JDWM2JNA2G43PA
X-MailFrom: aaron@parecki.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [OAUTH-WG] Re: I-D Action: draft-ietf-oauth-browser-based-apps-19.txt
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/pTzw3cT83Dxr1rNv1M8LAmAyAWs>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>
While we wait for the shepherd writeup, I noticed this draft was going to expire before IETF 121. This version just updates references in the doc. Aaron On Sun, Oct 20, 2024 at 4:06 PM <internet-drafts@ietf.org> wrote: > Internet-Draft draft-ietf-oauth-browser-based-apps-19.txt is now > available. It > is a work item of the Web Authorization Protocol (OAUTH) WG of the IETF. > > Title: OAuth 2.0 for Browser-Based Applications > Authors: Aaron Parecki > David Waite > Philippe De Ryck > Name: draft-ietf-oauth-browser-based-apps-19.txt > Pages: 62 > Dates: 2024-10-20 > > Abstract: > > This specification details the threats, attack consequences, security > considerations and best practices that must be taken into account > when developing browser-based applications that use OAuth 2.0. > > Discussion Venues > > This note is to be removed before publishing as an RFC. > > Discussion of this document takes place on the Web Authorization > Protocol Working Group mailing list (oauth@ietf.org) which is > archived at https://mailarchive.ietf.org/arch/browse/oauth/. > > Source for this draft and an issue tracker can be found at > https://github.com/oauth-wg/oauth-browser-based-apps. > > The IETF datatracker status page for this Internet-Draft is: > https://datatracker.ietf.org/doc/draft-ietf-oauth-browser-based-apps/ > > There is also an HTML version available at: > https://www.ietf.org/archive/id/draft-ietf-oauth-browser-based-apps-19.html > > A diff from the previous version is available at: > > https://author-tools.ietf.org/iddiff?url2=draft-ietf-oauth-browser-based-apps-19 > > Internet-Drafts are also available by rsync at: > rsync.ietf.org::internet-drafts > > > _______________________________________________ > OAuth mailing list -- oauth@ietf.org > To unsubscribe send an email to oauth-leave@ietf.org >
- [OAUTH-WG] I-D Action: draft-ietf-oauth-browser-b… internet-drafts
- [OAUTH-WG] Re: I-D Action: draft-ietf-oauth-brows… Aaron Parecki