Re: [T2TRG] RESTful Design & Security

[Carsten Bormann <[e-mail]>]

On 6 Mar 2017, at 17:59, Hannes Tschofenig <[e-mail]> wrote:
> 
> From the web we know that TLS goes very well with RESTful designs.

HTTPS works well as long as your security is binary: You switch it off or you switch it on; there are no different security requirements for different applications.  With this restriction, you can encode “security=on” in the URI (here: by choosing a different URI scheme, which unfortunately has other side effects).  (The disadvantages of coloring all cases with the same brush are also well known in the Big Web; I’m not discussing this here.  EV certs are a weird way to try escaping this restriction, but aren’t generally applicable to REST applications.)

It is well understood that we currently don’t have a good way to associate more extensive security information with a URI when that is required.  This comes up again and again (say, https://github.com/core-wg/oscoap/issues/41).  Is augmenting the URI by other information as in link-format the right way to do this in a more general scope?  This is an interesting subject for discussion.

Grüße, Carsten