Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Christer Holmberg <[e-mail]>]

Hi,

... 

>> All I am saying is that one should not send a token to someone that it has NOT been issued for.
>    
>    Then you are saying that a token should *never* be included in a request 
>    to a target for which you have not received a challenge some time in the 
>    past.
>    
>    That is a bit extreme, but I guess you can specify that if you think it 
>    is the right thing to do.

That is my understanding of the generic OAuth security considerations: you don't give a token to someone it was not intended for.

Of course, if you know (based on whatever configuration/policy) that it's ok to give the token to the target I guess you could do it.
    
>    But note that this logic won't always work for Proxy-Authenticate. You 
>    *might* know that a particular proxy will be visited (if it is mentioned 
>    on a Route header), but it is pretty common for the request to visit 
>    proxies unknown (at least in advance) to the UAC.
  
It is important to remember that, since the token needs to be protected, a proxy needs to have the associated protection credentials to be able to access the token. 

Regards,

Christer