Re: [stir] Proposal for update of erratum #6519

[Roman Shpount <[e-mail]>]

On Mon, Apr 19, 2021 at 7:56 PM Marc Petit-Huguenin <[e-mail]>
wrote:

> A literalist.  Fantastic.
>

I did not know we are supposed to judge this errata on artistic merits.

Now, can we go back to fix that text ?
>

This is exactly what I am doing.

My understanding was that grammar was defined as ident-type = "ppt" EQUAL (
token / ( LDQUOT token RDQUOT ) ) explicitly to avoid these sorts of
issues. I agree with your note that the new syntax does not allow for
spaces immediately before or immediately after the token when quoted and I
think it should be present in the errata. I also think that we should add a
note that even though the ppt value is case insensitive, a normalized
version as defined in
https://www.iana.org/assignments/passport/passport.xhtml (or all lower case
version) should be used when constructing a JWT header.


> >
> > Also, I thought the group decision was endpoints MUST accept ppt value
> as a
> > token with or without quotes. Endpoints MUST send a token in quotes. I
> have
> > explicitly asked if the group wanted SHOULD in either place, and the
> > preference was for the MUST level requirements. I think the errata should
> > say this unless there is a good reason to change it.
>
> That was not my understanding.
>

We can go back to the recording to check on the decision.

More importantly, what is the normative strength of "be tolerant to the
absence of quotes when receiving"? Is this MUST accept quotes? SHOULD
accept quotes?

In the sentence "Implementations SHOULD use quotes around the token when
sending", what would be the valid use cases when implementations are
allowed not to use quotes?

My understanding is that SHOULD implies well know exceptions.

Best Regards,
_____________
Roman Shpount