Re: [quicwg/base-drafts] The method of identifying "the same server" (#3155)

[Igor Lubashev <[e-mail]>]

@kazuho 
> There is no requirement for the client to check it's address (or the network).

@martinthomson 
> As @kazuho says, a client might choose to constrain token use to particular networks, but it doesn't have to. 

Indeed, that's correct, no requirement to check address/network on first use. There is language about reuse that does require the check (but the reuse itself is not required / actually discouraged): "A client MUST NOT reuse a token if it believes that its point of network attachment has changed since the token was last used; that is, if there is a change in its local IP address or network interface." 

I think I can live with the new language, since it gives clients enough flexibility in case they believe that the server that issued the token and the new server cooperate in managing the tokens (including a belief that they are the same server).  So no objection to the current language in #3156 on my part.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3155#issuecomment-553690770