Re: [OAUTH-WG] [OPS-DIR] Opsdir telechat review of draft-ietf-oauth-native-apps-10

wangzitao <> Tue, 23 May 2017 02:50 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 247F2129503; Mon, 22 May 2017 19:50:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.221
X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 2jGrQvNr14cn; Mon, 22 May 2017 19:50:26 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 9F8D91294D8; Mon, 22 May 2017 19:50:24 -0700 (PDT)
Received: from (EHLO ([]) by (MOS 4.3.7-GA FastPath queued) with ESMTP id DNO75742; Tue, 23 May 2017 02:50:22 +0000 (GMT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 14.3.301.0; Tue, 23 May 2017 03:50:21 +0100
Received: from ([]) by ([]) with mapi id 14.03.0301.000; Tue, 23 May 2017 10:50:17 +0800
From: wangzitao <>
To: William Denniss <>
CC: "" <>, "" <>, "" <>, "" <>
Thread-Topic: [OPS-DIR] Opsdir telechat review of draft-ietf-oauth-native-apps-10
Thread-Index: AdLSqDVW3BTeNlgFQ6WqlwAw3ux67gAQ4yYAACDVwOA=
Date: Tue, 23 May 2017 02:50:17 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: zh-CN
x-originating-ip: []
Content-Type: multipart/alternative; boundary="_000_E6BC9BBCBCACC246846FC685F9FF41EA2AE09727DGGEMM506MBXchi_"
MIME-Version: 1.0
X-CFilter-Loop: Reflected
X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020203.5923A36F.0037, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32
X-Mirapoint-Loop-Id: 19faa7ae4a8c3e6c71edad8340774957
Archived-At: <>
Subject: Re: [OAUTH-WG] [OPS-DIR] Opsdir telechat review of draft-ietf-oauth-native-apps-10
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 23 May 2017 02:50:39 -0000

Cool! This changes/explains make sense to me.

Best Regards!

发件人: William Denniss []
发送时间: 2017年5月23日 3:09
收件人: wangzitao
主题: Re: [OPS-DIR] Opsdir telechat review of draft-ietf-oauth-native-apps-10

Thanks for your review Zitao!

Version 12 addresses your comments. Detailed responses below:

On Sun, May 21, 2017 at 8:05 PM, wangzitao <<>> wrote:

Reviewer: Zitao Wang (Michael)

Review result: Has Nits

I have reviewed this document as part of the Operational directorate’s ongoing effort to review all IETF documents being processed by the IESG.  These comments were written with the intent of improving the operational aspects of the IETF drafts. Comments that are not addressed in last call may be included in AD reviews during the IESG review.  Document editors and WG chairs should treat these comments just like any other last call comments.

Document reviewed:  draft-ietf-oauth-native-apps-10


OAuth 2.0 authorization requests from native apps should only be made
through external user-agents, primarily the user’s browser. This
specification details the security and usability reasons why this is
the case, and how native apps and authorization servers can implement

this best practice.

I think the document is written very clear, except some small nits:

Page 3:     The last sentence of introduction-- “This practice is also known as the AppAuth pattern”.

I suggest adding a reference to explain the AppAuth pattern.


Page 3:     Terminology -- "OAuth".

I suggest modifying to: "OAuth"   The Web Authorization (OAuth) protocol.  In this document, OAuth refers to OAuth 2.0 [RFC6749].
I went with:
"In this document, OAuth refers to the OAuth 2.0 Authorization Framework [RFC6749]."

The phrase "Web Authorization (OAuth) protocol" only seems to appear in our WG Charter, and not general usage<>.

Page 4:     Terminology -- "web-view"  A web browser UI component.

Does it mean "User Information"?  Suggest expanding this abbreviation.


Page 5:     Figure 1.   Does the browser and authorization endpoint are some kinds of "external user-agent"? Suggest describing it more clearly.

Now states:
"illustrates the interaction of the native app with a browser
        external user-agent to authorize the user. "

Page   9:   PKCE [RFC7636] details how this limitation can be used to execute a code interception attack (see Figure 1).

Does the Figure 1 means “Figure 1 of RFC7636”?

Good catch. I delete the figure reference, since the entire spec talks about this attack, which is likely sufficient.

Page10:     However, as the Implicit Flow cannot be protected by PKCE
Seems here, the reference be omitted.


A run of idnits revealed no errors, flaws. There were 1 warning and 1 comments though

  == There are 1 instance of lines with non-RFC2606-compliant FQDNs in the


I ran it myself with verbose output, and got:

tmp/draft-ietf-oauth-native-apps__1_.txt(435): Found possible FQDN '' in position 5; this doesn't match RFC 2606's suggested ".example" or ".example.(com|org|net)".

We are actually using a RFC2606 domain name here, but in reverse domain name notation which is causing this warning.

No changes required.

  Miscellaneous warnings:


  -- The document date (April 26, 2017) is 14 days in the past.  Is this


  Checking references for intended status: Best Current Practice


     (See RFCs 3967 and 4897 for information about using normative references

     to lower-maturity documents in RFCs)

     No issues found here.

     Summary: 0 errors (**), 0 flaws (~~), 1 warning (==), 1 comment (--).


OPS-DIR mailing list<>