Re: [Unbearable] on not listing 'Sec-Token-Binding' in the Connection header field?

[Andrei Popov <[e-mail]>]

Ø  If it is negotiating token binding with the server then it can’t pass along the original token binding in the same header without significant confusion I suspect.
My argument is that a TB-aware proxy understands this and does the right thing, which may be validating the client’s TB and generating a new TB for the back-end server, or something else.


Ø  The bigger short term question is what should a proxy that doesn’t understand token binding do.  If token binding is signalled from the user agent as hop by hop then it should drop the header.
A proxy that does not understand TB, but terminates TLS, does not negotiate TB with the client and does not receive the TB header.


Ø  I think it is better for the server to get no token binding header than one from a client that thinks it has negotiated token binding but it cant validate.
The client only sends the TB header if TB was negotiated. This means the proxy and/or back-end server are configured by the admin to handle TB.
The client does not know whether the proxy or the back-end server handle TB, so can’t make a header forwarding decision for them.