Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Rifaat Shekh-Yusef <[e-mail]>]

On Tue, Jul 9, 2019 at 11:43 AM Christer Holmberg <
[e-mail]> wrote:

> Hi,
>
> >> As I said in another reply, if you by default place a REGISTER token in
> a non-REGISTER request the token may reach the remote peer, which could be
> a security concern.
> >
> >    I would like to hear more about this. Is there something about the
> token
> >    that reveals stuff that might not be suitable to expose to everyone?
> I
> >    personally don't know. This seems like something that ought to be
> >    discussed in security considerations.
>
> The token itself does not reveal anything,


That depends on the type of token.
A JWT might contain data that must be protected for privacy reasons.


but in OAuth the token is used to access the requested resource, so it is
> considered sensitive information.
>
>
Yeah, because these are *bearer *tokens it means that they are not bind to
a specific UA.
There are ways to bind a token to a specific UA (see RFC7800), but this is
out of scope for this document

Regards,
 Rifaat




> As far as I know, OAuth for SIP has only been used for REGISTER requests,
> between the UA and the registrar. I have never heard about anyone using it
> for non-REGISTER authentication, and I wonder whether we even need to cover
> it in the draft. We could limit the scope the REGISTER requests. Then, if
> anyone ever needs OAuth for non-REGISTER requests, a separate draft can be
> written.
>
> Regards,
>
> Christer
>
>
>
> _______________________________________________
> sipcore mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sipcore
>