Re: [OAUTH-WG] draft-hammer-oauth-v2-mac-token-02

Here's a thought:

	signed_content="request,query,body"

If not included, it defaults to "request,query". It's non-breaking (except for the implied removal of bodyhash), allows for either body or query content to be omitted from the signature, and looks less ugly than bodyhash=true.  If you prefer, the value of this attribute could be one of a predefined string (request_query, request_query_body, request, etc.) rather than individual parsed elements.

On Feb 7, 2011, at 6:26 PM, Eran Hammer-Lahav wrote:

> Yeah...
> 
> I struggled with that. There is no reason to include the body hash with the request other than to indicate a body hash is included in the normalized request string. It's just that an attribute like 'bodyhash=true' is so ugly...
> 
> I'm still thinking about this.
> 
> EHL
> 
>> -----Original Message-----
>> From: Skylar Woodward [mailto:skylar@kiva.org]
>> Sent: Monday, February 07, 2011 9:25 AM
>> To: Eran Hammer-Lahav; OAuth WG
>> Subject: Re: [OAUTH-WG] draft-hammer-oauth-v2-mac-token-02
>> 
>> On body-hash...
>> 
>> Having completed a trial implementation, it seems redundant, and
>> potentially problematic, to include the body-hash in the Authentication
>> header. The danger is that implementors may neglect to recalculate the hash
>> themselves, reusing the value (even if incorrect) provided by the client. Why
>> not just require the provider to calculate this and validate it by comparing the
>> final signature? This way it's clearer for everyone what the expectations are
>> in validating the signature.
>> 
>> I propose either a flag (eg, usebodyhash="1") or an algorithm
>> (bodyhashalgorithm="sha1"). If this parameter was provided, the correct
>> hash would be added to the base string for signing. If omitted (or set false?)
>> then an empty string is used for base string element #4.
>> 
>> 
>> On including parameters for signing...
>> 
>> I'd retract my suggestion that we'd include parameter-hash in the header.
>> Instead, I would suggest making parameters optional in calculating the
>> signature using a flag as with bodyhash. Providers could require including
>> parameters if so desired. Parameters could be included as currently defined,
>> or with a hash method similar to entity-body (which I find both simpler and
>> more congruent).
>> 
>> Again, the goal in making query parameters optional is to allow providers to
>> make signature calculation as simple as possible for clients (so much as it is in
>> line with the security requirements of the provider) and avoid complexities in
>> implementation such as those that tripped up OAuth 1.
>> 
>> 
>> 
>> On Jan 22, 2011, at 2:09 AM, Eran Hammer-Lahav wrote:
>> 
>>> http://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-02
>>> 
>>> New version includes the following changes:
>>> 
>>>   o  Added body-hash support.
>>>   o  Updated OAuth 2.0 reference to -12 and added token type registration
>> template.
>>>   o  Removed error and error URI attributes (codes were just a duplication
>> of the HTTP status codes).
>>> 
>>> Feedback would be greatly appreciated.
>>> 
>>> EHL
>>> 
>>> 
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
> 