Date: Mon, 07 Jan 2019 22:32:02 -0800
From: Kazuho Oku <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+0166e4abaf36a02a33d35eace1192d94ae84495813f4ea1b92cf00000001184c05e292a169ce178a34b7@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/2279/452190473@github.com>
In-Reply-To: <quicwg/base-drafts/issues/2279@github.com>
References: <quicwg/base-drafts/issues/2279@github.com>
Subject: Re: [quicwg/base-drafts] address-based access control (#2279)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5c3443e22259b_10e23fb454cd45b83601ab";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/84WoRY4wcp-MqMpjZlEOe148Hb0>


----==_mimepart_5c3443e22259b_10e23fb454cd45b83601ab
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

@janaiyengar 
> One advice here could be that if a server needs the client to not move to a different IP address, it can simply disable migration via the disable_migration TP. This is a policy decision of course.

I am not sure if I agree with the framing.

It is often the case that only _some_ of the URIs of an origin applies address-based authentication. I do not think that disallowing migration for the entire origin is the correct solution.

I think it is better to encourage (or requires) HTTP servers to consider "current IP address" as the client address of each HTTP request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2279#issuecomment-452190473
----==_mimepart_5c3443e22259b_10e23fb454cd45b83601ab
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p><a class=3D"user-mention" data-hovercard-type=3D"user" data-hovercard-=
url=3D"/hovercards?user_id=3D11067604" data-octo-click=3D"hovercard-link-=
click" data-octo-dimensions=3D"link_type:self" href=3D"https://github.com=
/janaiyengar">@janaiyengar</a></p>
<blockquote>
<p>One advice here could be that if a server needs the client to not move=
 to a different IP address, it can simply disable migration via the disab=
le_migration TP. This is a policy decision of course.</p>
</blockquote>
<p>I am not sure if I agree with the framing.</p>
<p>It is often the case that only <em>some</em> of the URIs of an origin =
applies address-based authentication. I do not think that disallowing mig=
ration for the entire origin is the correct solution.</p>
<p>I think it is better to encourage (or requires) HTTP servers to consid=
er "current IP address" as the client address of each HTTP request.</p>

<p style=3D"font-size:small;-webkit-text-size-adjust:none;color:#666;">&m=
dash;<br />You are receiving this because you are subscribed to this thre=
ad.<br />Reply to this email directly, <a href=3D"https://github.com/quic=
wg/base-drafts/issues/2279#issuecomment-452190473">view it on GitHub</a>,=
 or <a href=3D"https://github.com/notifications/unsubscribe-auth/AWbkq75O=
Sv7wSVyVFDrMwjWAAISWf4Pfks5vBDtigaJpZM4ZlOJ-">mute the thread</a>.<img sr=
c=3D"https://github.com/notifications/beacon/AWbkqyOL6KriJtb3je3HF03SdADM=
tFcPks5vBDtigaJpZM4ZlOJ-.gif" height=3D"1" width=3D"1" alt=3D"" /></p>
<script type=3D"application/json" data-scope=3D"inboxmarkup">{"api_versio=
n":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name"=
:"GitHub"},"entity":{"external_key":"github/quicwg/base-drafts","title":"=
quicwg/base-drafts","subtitle":"GitHub repository","main_image_url":"http=
s://github.githubassets.com/images/email/message_cards/header.png","avata=
r_image_url":"https://github.githubassets.com/images/email/message_cards/=
avatar.png","action":{"name":"Open in GitHub","url":"https://github.com/q=
uicwg/base-drafts"}},"updates":{"snippets":[{"icon":"PERSON","message":"@=
kazuho in #2279: @janaiyengar \r\n\u003e One advice here could be that if=
 a server needs the client to not move to a different IP address, it can =
simply disable migration via the disable_migration TP. This is a policy d=
ecision of course.\r\n\r\nI am not sure if I agree with the framing.\r\n\=
r\nIt is often the case that only _some_ of the URIs of an origin applies=
 address-based authentication. I do not think that disallowing migration =
for the entire origin is the correct solution.\r\n\r\nI think it is bette=
r to encourage (or requires) HTTP servers to consider \"current IP addres=
s\" as the client address of each HTTP request."}],"action":{"name":"View=
 Issue","url":"https://github.com/quicwg/base-drafts/issues/2279#issuecom=
ment-452190473"}}}</script>
<script type=3D"application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/issues/2279#issuecomment=
-452190473",
"url": "https://github.com/quicwg/base-drafts/issues/2279#issuecomment-45=
2190473",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>=

----==_mimepart_5c3443e22259b_10e23fb454cd45b83601ab--