Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Paul Kyzivat <[e-mail]>]

On 7/9/19 11:42 AM, Christer Holmberg wrote:
> Hi,
>      
>>> As I said in another reply, if you by default place a REGISTER token in a non-REGISTER request the token may reach the remote peer, which could be a security concern.
>>     
>>     I would like to hear more about this. Is there something about the token
>>     that reveals stuff that might not be suitable to expose to everyone? I
>>     personally don't know. This seems like something that ought to be
>>     discussed in security considerations.
>    
> The token itself does not reveal anything, but in OAuth the token is used to access the requested resource, so it is considered sensitive information.
> 
> As far as I know, OAuth for SIP has only been used for REGISTER requests, between the UA and the registrar. I have never heard about anyone using it for non-REGISTER authentication, and I wonder whether we even need to cover it in the draft. We could limit the scope the REGISTER requests. Then, if anyone ever needs OAuth for non-REGISTER requests, a separate draft can be written.

Yes, you can do that if you wish. But ISTM that the issues are largely 
the same so I don't know why you would do that.

	Thanks,
	Paul