IETF Logo Mail Archive

Re: [OAUTH-WG] Ignoring unrecognized request parameters

Eran Hammer <eran@hueniverse.com> Thu, 16 February 2012 23:01 UTC

Return-Path: <eran@hueniverse.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3811821E8042 for <oauth@ietfa.amsl.com>; Thu, 16 Feb 2012 15:01:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.51
X-Spam-Level:
X-Spam-Status: No, score=-2.51 tagged_above=-999 required=5 tests=[AWL=0.088, BAYES_00=-2.599, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3MKGegBmNkmF for <oauth@ietfa.amsl.com>; Thu, 16 Feb 2012 15:01:39 -0800 (PST)
Received: from p3plex1out01.prod.phx3.secureserver.net (p3plex1out01.prod.phx3.secureserver.net [72.167.180.17]) by ietfa.amsl.com (Postfix) with SMTP id 0DB7521F87E4 for <oauth@ietf.org>; Thu, 16 Feb 2012 15:01:38 -0800 (PST)
Received: (qmail 14975 invoked from network); 16 Feb 2012 23:01:37 -0000
Received: from unknown (HELO smtp.ex1.secureserver.net) (72.167.180.20) by p3plex1out01.prod.phx3.secureserver.net with SMTP; 16 Feb 2012 23:01:32 -0000
Received: from P3PW5EX1MB01.EX1.SECURESERVER.NET ([10.6.135.20]) by P3PW5EX1HT002.EX1.SECURESERVER.NET ([72.167.180.20]) with mapi; Thu, 16 Feb 2012 16:01:24 -0700
From: Eran Hammer <eran@hueniverse.com>
To: John Bradley <ve7jtb@ve7jtb.com>, William Mills <wmills@yahoo-inc.com>
Date: Thu, 16 Feb 2012 16:01:46 -0700
Thread-Topic: [OAUTH-WG] Ignoring unrecognized request parameters
Thread-Index: Aczs/ueneCWSoMuBQtahNOsUaDEsOA==
Message-ID: <CB62CAAF.12FF3%eran@hueniverse.com>
In-Reply-To: <95549D89-B2AB-4A40-96CE-C689DB07BF88@ve7jtb.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/14.14.0.111121
acceptlanguage: en-US
Content-Type: multipart/alternative; boundary="_000_CB62CAAF12FF3eranhueniversecom_"
MIME-Version: 1.0
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Ignoring unrecognized request parameters
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Feb 2012 23:01:43 -0000

Can you give an example where an unknown parameter being ignored can lead to security issues?

EH


From: John Bradley <ve7jtb@ve7jtb.com<mailto:ve7jtb@ve7jtb.com>>
Date: Thu, 16 Feb 2012 11:55:21 -0700
To: William Mills <wmills@yahoo-inc.com<mailto:wmills@yahoo-inc.com>>
Cc: "oauth@ietf.org<mailto:oauth@ietf.org>" <oauth@ietf.org<mailto:oauth@ietf.org>>
Subject: Re: [OAUTH-WG] Ignoring unrecognized request parameters

If you have a generic client that works across multiple Authorization endpoints some that have extension X and others not, I can see that having the Authorization servers ignore unknown parameters is desirable.

However there are some endpoints that are not going to be able to allow unknown parameters due to there security policy.   They are often a indication of an attack.

If this remains a MUST then some endpoints will have to ignore it, and be non compliant.

I would be OK with something like "MUST ignore unknown parameters unless the endpoint is required to return an error due to local security policy."

There is probably no perfect compromise on this one.

John B.


On 2012-02-16, at 3:32 PM, William Mills wrote:

No, this is required for forward compatibility.  Implementations that send extended parameters like capability advertisements (i.e. CAPTCHA support or something) shoudl not be broken hitting older implementations.

________________________________
From: Mike Jones <Michael.Jones@microsoft.com<mailto:Michael.Jones@microsoft.com>>
To: "oauth@ietf.org<mailto:oauth@ietf.org>" <oauth@ietf.org<mailto:oauth@ietf.org>>
Sent: Thursday, February 16, 2012 10:16 AM
Subject: [OAUTH-WG] Ignoring unrecognized request parameters

In core -23, the last paragraph of section 3.1<http://tools.ietf.org/html/draft-ietf-oauth-v2-23#section-3.1> now says:

                The authorization server MUST ignore unrecognized request parameters.

In -22, this said:

                The authorization server SHOULD ignore unrecognized request parameters.

In a security protocol, it seems unreasonable to require that information be ignored.  As I see it, it SHOULD be legal to return an error if unrecognized information is received.

Why the change?  And can we please have it changed back to SHOULD in -24?

                                                                Thanks,
                                                                -- Mike


_______________________________________________
OAuth mailing list
OAuth@ietf.org<mailto:OAuth@ietf.org>
https://www.ietf.org/mailman/listinfo/oauth


_______________________________________________
OAuth mailing list
OAuth@ietf.org<mailto:OAuth@ietf.org>
https://www.ietf.org/mailman/listinfo/oauth

v2.14.0 | Report a Bug | By Email