Re: [websec] Strict-Transport-Security syntax redux

Julian Reschke <julian.reschke@gmx.de> Thu, 29 December 2011 12:39 UTC

Return-Path: <julian.reschke@gmx.de>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C46C21F858D for <websec@ietfa.amsl.com>; Thu, 29 Dec 2011 04:39:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.449
X-Spam-Level:
X-Spam-Status: No, score=-104.449 tagged_above=-999 required=5 tests=[AWL=-1.850, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o7RYH60rcwuJ for <websec@ietfa.amsl.com>; Thu, 29 Dec 2011 04:39:33 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by ietfa.amsl.com (Postfix) with SMTP id 4CC3321F84A6 for <websec@ietf.org>; Thu, 29 Dec 2011 04:39:33 -0800 (PST)
Received: (qmail invoked by alias); 29 Dec 2011 12:39:31 -0000
Received: from mail.greenbytes.de (EHLO [192.168.1.140]) [217.91.35.233] by mail.gmx.net (mp032) with SMTP; 29 Dec 2011 13:39:31 +0100
X-Authenticated: #1915285
X-Provags-ID: V01U2FsdGVkX1+O6AYOfuOO+JShqCoZ0doZBJJPNBdm0D67onxtJZ hzVKFK2sishgZY
Message-ID: <4EFC5F7B.7050304@gmx.de>
Date: Thu, 29 Dec 2011 13:39:23 +0100
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0) Gecko/20111222 Thunderbird/9.0.1
MIME-Version: 1.0
To: =JeffH <Jeff.Hodges@KingsMountain.com>
References: <4EAB66B3.4090404@KingsMountain.com> <4EABB25E.9000900@gmx.de>
In-Reply-To: <4EABB25E.9000900@gmx.de>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
Cc: IETF WebSec WG <websec@ietf.org>
Subject: Re: [websec] Strict-Transport-Security syntax redux
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Dec 2011 12:39:34 -0000

Hi there,

Looking at 
<http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-03>.

I note that the spec doesn't state what ABNF syntax it uses; something 
like <http://greenbytes.de/tech/webdav/rfc5988.html#rfc.section.2.p.2> 
should be added.

Now for the actual ABNF 
(<http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-03#section-5.1>):

     Strict-Transport-Security = "Strict-Transport-Security" ":"
                                     directive *( ";" [ directive ] )

This works for me.

     directive         = max-age | includeSubDomains | STS-d-ext

     max-age           = "max-age" "=" delta-seconds

     includeSubDomains = "includeSubDomains"

     STS-d-ext     = token [ "=" ( token | quoted-string ) ]

I would turn that around; a parser for STS should parse all directives 
the same way, thus:

     directive         = token [ "=" ( token | quoted-string ) ]

And then state that this spec defines two directives, and future specs 
can define more (maybe you need to state how to do that; "update" this 
spec? Add registry?)

Then, for max-age and includeSubDomains, define their individual syntax 
separately, and don't forget to describe what to do with things like:

   includeSubDomains="true"

or

   max-age

or

   max-age="10"

Also:

    The max-age directive MUST appear once in the Strict-Transport-
    Security header field value.  The includeSubDomains directive MAY
    appear once.  The order of appearance of directives in the Strict-
    Transport-Security header field value is not significant.

It would be better to state that *each* directive (including future 
ones) must appear only once, and that max-age is REQUIRED and 
includeSubDomains is OPTIONAL.

(BTW: wouldn't it make sense to have a default for max-age so it can be 
made OPTIONAL?)

Best regards, Julian