IETF Logo Mail Archive

Re: [OAUTH-WG] is updated guidance needed for JS/SPA apps?

"Brock Allen" <brockallen@gmail.com> Fri, 18 May 2018 17:55 UTC

Return-Path: <brockallen@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E335412D95D for <oauth@ietfa.amsl.com>; Fri, 18 May 2018 10:55:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Level:
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kqAwX_m15Yjq for <oauth@ietfa.amsl.com>; Fri, 18 May 2018 10:55:50 -0700 (PDT)
Received: from mail-qk0-x236.google.com (mail-qk0-x236.google.com [IPv6:2607:f8b0:400d:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50D1412D942 for <oauth@ietf.org>; Fri, 18 May 2018 10:55:50 -0700 (PDT)
Received: by mail-qk0-x236.google.com with SMTP id b22-v6so7095806qkj.9 for <oauth@ietf.org>; Fri, 18 May 2018 10:55:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:date:message-id:subject:from:to:cc:in-reply-to :references:user-agent; bh=Jw3N2yrbgQ0XUf1GNQDCrc+RwLDv5yMSxhA1h2y0/Zw=; b=HbzPQeIk0+eG9l1sOc98tc9DYFKTm3XPAN2sMDbKK1wuUYAWBhCSjEpp0QIN8cPMp7 CDWtWxQLkqgotbMnO9g97MsB4VJ7YTWOVsLcZ6pGZh5QmLsAFU/PqjdURR9RPzplcwhS AnLOWxIiPmY6gAZWsFw/zOlfri8sBIfJqnyboIVxCe4KexI0TLXObTSV5UDHzwMXoEcH u74JZH4lPhry4sRUoDGQswu9c0w6tEpniIEI0l808ZZjzzK/LXwXyPu0iUCf0DOm+Adv OKzHhWg/w9lvKmjnrXT+wnIUo/Z0GleCpN1Cc6sK0kAKkm93ihIcOkbx1UCnJcKiQn1C iT5Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:message-id:subject:from:to:cc :in-reply-to:references:user-agent; bh=Jw3N2yrbgQ0XUf1GNQDCrc+RwLDv5yMSxhA1h2y0/Zw=; b=sJwz+C8DgVN0IuD5srkhpfeC+e7G3/N9vsXA3S7XFl2sAZTW8e7xto3TuZsOMsZcDc IsfRnpzXaiGxuHMqzVEl5t7awDPwp4P1kxAYBMQGLqdqz8zBfeeJR9u/Jl6Q6AndrLiF sNS+kbyYNJSCjJ3ja1cxhYu54DTzGKSKHlVGoPjVPMe+KMxAjhIYz6RCSVFj5A/Etmbk ffpatJtZFCTCZqhkAOKf548U6//C8pRP/F2rRuFC/luHcB37hvQnTzbNdpIZq4D2spHs Z4BV+zv/f83+6rP6gDinEC6krm5r3Bo8tjgAJFoPPavoLreHcBM9u0rWP28WV7o1lGVD FXKw==
X-Gm-Message-State: ALKqPwcNSNwL+sWf8fcJKupAjcJoz+8DKNUC3lhpyOabG0S3coi7ia3L Fogy6/z/3tPamF8YRWjzt/w=
X-Google-Smtp-Source: AB8JxZqvMyQfsKZeKPRLG2QOc27JRtj4jAI/CsdKd2VW+xGFYaMrArGzKzQVYEHntT01TnvORIozxA==
X-Received: by 2002:a37:5ac5:: with SMTP id o188-v6mr9340870qkb.295.1526666149052; Fri, 18 May 2018 10:55:49 -0700 (PDT)
Received: from [172.20.10.3] ([172.58.233.201]) by smtp.gmail.com with ESMTPSA id q8-v6sm5967398qtb.13.2018.05.18.10.55.48 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 18 May 2018 10:55:48 -0700 (PDT)
Content-Type: multipart/alternative; boundary="----=_NextPart_12625737.623923963556"
MIME-Version: 1.0
Date: Fri, 18 May 2018 13:55:42 -0400
Message-ID: <5076c4e6-ae3f-4632-b133-146a04db7ec9@getmailbird.com>
From: Brock Allen <brockallen@gmail.com>
To: David Waite <david@alkaline-solutions.com>, John Bradley <ve7jtb@ve7jtb.com>
Cc: Hannes Tschofenig <hannes.tschofenig@arm.com>, oauth@ietf.org
In-Reply-To: <0075D910-35DA-4B8B-A739-D57CF7A8765E@alkaline-solutions.com>
References: <ab42d84a-5f08-4600-aa36-92e73944cf6c@getmailbird.com> <VI1PR0801MB2112A6F8B47939F8748DEA43FA910@VI1PR0801MB2112.eurprd08.prod.outlook.com> <4B744041-8E6D-489C-8162-CE690C42543B@alkaline-solutions.com> <,895b7769-e2e9-4ce2-bc29-6abb6ba44732@getmailbird.com> <MWHPR19MB1085FC4579E0A656BB78A8ABFA900@MWHPR19MB1085.namprd19.prod.outlook.com> <22977d8a-ead8-49fe-83c0-46c5c594ac40@getmailbird.com> <5aff03b3.1c69fb81.a01df.2946@mx.google.com> <0075D910-35DA-4B8B-A739-D57CF7A8765E@alkaline-solutions.com>
User-Agent: Mailbird/2.5.8.0
X-Mailbird-ID: 5076c4e6-ae3f-4632-b133-146a04db7ec9@getmailbird.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/wmzVR1YQGBBNN9DadlToWaE5L-4>
Subject: Re: [OAUTH-WG] is updated guidance needed for JS/SPA apps?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 18 May 2018 17:55:52 -0000

> I don’t believe code flow today with an equivalent token policy as you have with implicit causes any new security issues, and it does correct _some_ problems. The problem is that you immediately want to change token policy to get around hidden iframes and special parameters.


Hidden frames and special params -- are those really the main concerns with implicit? Those are just different mechanics to do the same thing. IMO, iframes are just another way to "do" HTTP, albeit more clumsy and effort than XMLHttpRequest. And in my experience, prompt=none is easily done and well supported. Perhaps my perspective is skewed.

I thought the access token being sent in the URL is a bigger concern, and that's why code+PKCE is a better approach.

-Brock

v2.20.3 | Report a Bug | By Email