Re: [Unbearable] on not listing 'Sec-Token-Binding' in the Connection header field?

[Amos Jeffries <[e-mail]>]

On 10/02/2017 8:24 a.m., John Bradley wrote:
> So it is valid in hop by hop for the proxy to pass on the original
> header information as its own for the next hop if that is the correct
> thing to do?
> 
> I suppose that is largely what happens with keep-alive.
> 

Yes.

The other parallel is the various Proxy-Auth* headers from RFC 7235.
Which are defined explicitly as point-to-point (not quite hop-by-hop, so
Connection entry is optional) then section 4.4 explicitly calls out the
exception case:
"
   ... When multiple proxies are used in a chain,
   the Proxy-Authorization header field is consumed by the first inbound
   proxy that was expecting to receive credentials.  A proxy MAY relay
   the credentials from the client request to the next proxy if that is
   the mechanism by which the proxies cooperatively authenticate a given
   request.
"

This is almost exactly the same as the intended behaviour for the
non-validating TTRP use case with Sec-Token-Binding.

Amos