Re: [quicwg/base-drafts] Document what needs to be checked for address validation (#2125)

MikkelFJ <> Wed, 12 December 2018 15:08 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 209FA127333 for <>; Wed, 12 Dec 2018 07:08:11 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -8.056
X-Spam-Status: No, score=-8.056 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.46, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id WXDImy5dv9VZ for <>; Wed, 12 Dec 2018 07:08:09 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 635B3127133 for <>; Wed, 12 Dec 2018 07:08:09 -0800 (PST)
Date: Wed, 12 Dec 2018 07:08:08 -0800
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1544627288; bh=miomJ4WnIxKxeQTPII8xAl6RT0ucYdY21Nr/E7DSA88=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=LzdwhBmXGEx71eksEdut35jiGbFXfqVrlAWGExEItAGKTZ8Sxh5kdO015NF4YgTrr p1iaHjHQl9hn74Ivyj74wJCNFks1EbUBMkv11yVpcPbo/1BenOcvb7vHcX+dzP1Bk1 6DyY6y7isNmRRWCy5+y3swRpsryGHMY8jlHIrWa4=
From: MikkelFJ <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/issues/2125/>
In-Reply-To: <quicwg/base-drafts/issues/>
References: <quicwg/base-drafts/issues/>
Subject: Re: [quicwg/base-drafts] Document what needs to be checked for address validation (#2125)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5c112458747b8_5adb3faad62d45b8130380"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: mikkelfj
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 12 Dec 2018 15:08:11 -0000

I'm wondering about the case where a token is received and has expired and is otherwise valid.

There are several cases:

1. injection attack - replay etc.
2. valid token
3. valid token, but expired, based on servers internal algorithm
4. invalid token, fails servers integrity check

Sometimes it makes sense to close a connection, other times it might be more reasonable to ignore the token and force validation within the connection?

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: