[rtcweb] Alexey Melnikov's Discuss on draft-ietf-rtcweb-security-arch-18: (with DISCUSS)

[Alexey Melnikov <[e-mail]>]

Alexey Melnikov has entered the following ballot position for
draft-ietf-rtcweb-security-arch-18: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-rtcweb-security-arch/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thank you for a well written document!

My apologies for filing a procedural DISCUSS on this, but I am looking at:

7.5.  Determining the IdP URI

   3.  The path, starting with "/.well-known/idp-proxy/" and appended
       with the IdP protocol.  Note that the separator characters '/'
       (%2F) and '\' (%5C) MUST NOT be permitted in the protocol field,
       lest an attacker be able to direct requests outside of the
       controlled "/.well-known/" prefix.  Query and fragment values MAY
       be used by including '?' or '#' characters.

"idp-proxy" is not registered in the IANA's
<https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml>
registry and this document doesn't register it either. If I missed where this
is registered, please point me to the right document. If I haven't, please
register it in this document.