Re: [Unbearable] on not listing 'Sec-Token-Binding' in the Connection header field?

[Andrei Popov <[e-mail]>]

Hi Amos,

> The Connection header is not particularly about proxies. It is simply about distinguishing hop-by-hop things from end-to-end so any naive/old HTTP recipient can keep the relevant data secure in a fail-closed way.
...and TB can be handled hop-by-hop or passed on for subsequent validation; both are valid use-cases.

It would be a concern if the backend servers were to assume that any TB header (and the contained TB message) floating around is always valid. Instead what the specs currently say is that if you receive a TB message, you've got to validate it before accepting a bound token. If validation fails, the bound token is rejected. 

It seems therefore that stripping TB headers does not "fail closed", but simply eliminates the possibility that the contained TB message may get verified further down the line.

It is true that a proxy could forward Sec-Token-Binding's contents as a custom header, possibly specified in another document. This is a valid design; I'm just not convinced that this should be the only possible design.

Cheers,

Andrei