[quicwg/base-drafts] Provide guideline on token validation (#2132)

[MikkelFJ <[e-mail]>]

When receiving a token during handshake, several scenarios are possible following the same overall pattern even when the implementation and deployment decides the algorithmic and encoding details.


1. injection attack - replay etc.
2. valid token
3. valid token, but expired, based on servers internal algorithm
4. invalid token, fails servers integrity check

It would be helpful with guidance on how to approach these scenarios.

A token might be valid but timed out because there is an embedded timestamp, but it could also be because the server farm is being upgraded and new instances cannot validate old tokens thus potentially allowing a grace period where they ignore tokens they can verify at all.

Attacks are not trivially known to be attacks, or they wouldn't be attacks, but their existence affect how safe it is to reject a token with a closed connection vs ignoring the token. #2097 discusses injection attacks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2132