Re: [Unbearable] Ben Campbell's Yes on draft-ietf-tokbind-https-17: (with COMMENT)

[John Bradley <[e-mail]>]

Thanks Ben,

I have gone over 6 again, and think I see the confusion.

The point of section 6 is to remind platforms that provide native HTTP API to also expose token binding to the applications using them.

An example native app such as a OAuth client on a phone is not using redirects from the resource server to the Authorization Server, it is making a direct HTTP request to the AS Token Endpoint.   If that app wants to include the tokenbindingID from the connection to the Resource server as the referred token binding in the HTTP POST to the token endpoint it needs some way in the HTTP API to signal sending the referred token binding for the other connection.   

IETF specs slip into a grey area when we start talking about API.   The work group participants wanted to keep this goal oriented rather than having any wording that might impact there intended API implementations.

In the third paragraph it is true that native API should only convey the referred token binding to servers if signaled to do so by an application.

It is also true in a general sense both for redirect and JS browser apps as well.
I think that while true the third paragraph may have morphed into more of a general privacy concern, using redirect as an example.

Would it work for you if we refocus the third paragraph to focus specifically  on native apps.

Eg.  Native API MUST only convey referred token binding information if signaled by an application.

Then leave the rest to the Privacy Considerations reference.

That or just dropping the third paragraph.

Let me know and we can update in the final version 

Regards
John B.









The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-tokbind-https/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for addressing my DISCUSS and substantive comments in pre-submission
text. I did not check editorial comments.

I have one remaining (non-blocking) question on section 6: Are the
“applications” from paragraph 3 the same as those from paragraph 2? It seems
like paragraph 2 is talking more about local APIs (at least, I see that was
mentioned in the text in version 17 but not in 18), but paragraph 3 uses an
example of a signal from a server. (I can accept that the difference in control
may be weak enough for web applications that the distinction does not matter.)