[websec] Session Continuation = Session Bound State?

Phillip Hallam-Baker <hallam@gmail.com> Thu, 14 March 2013 03:49 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0395521F87CC for <websec@ietfa.amsl.com>; Wed, 13 Mar 2013 20:49:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ylu1uTb-0RqQ for <websec@ietfa.amsl.com>; Wed, 13 Mar 2013 20:49:55 -0700 (PDT)
Received: from mail-we0-x229.google.com (mail-we0-x229.google.com [IPv6:2a00:1450:400c:c03::229]) by ietfa.amsl.com (Postfix) with ESMTP id 1540B21F8712 for <websec@ietf.org>; Wed, 13 Mar 2013 20:49:54 -0700 (PDT)
Received: by mail-we0-f169.google.com with SMTP id t11so1731791wey.14 for <websec@ietf.org>; Wed, 13 Mar 2013 20:49:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:date:message-id:subject:from:to :content-type; bh=Jrqww+eRY3pJbjFjBt1hvRux0ztgggAQqtuCCXBOemo=; b=IBsUvtjOYImWsqL66F+gP1OjmFcBTW81uolZYaBOzcBRxDchvF1eAdA5h1qewIWDqZ DDpUpebAjgbjAM3Fa0DK56Lq/6bVhhnqE0cLe5ojpEDwHp3sJ9CcJcW3zkVsaOobIuu6 G+BBBu/XOoVvW+6vhTa6yUmGj8DeNW5qgHBoF/GZBRRgQb7opeol4wfSjHuHpXUo6E+g YqaYusxwE6JGDmbzhbjnHjiXCgb2cNdFcllHr2MXeOgXvJ8plktZvV85C2rx+0OGBo8p MaSkomQ3illKlcoUySl8z1VSMAghR0F7ZmG9HLbYNKuUyq4rwWttpIP9paha2Y0LHkA7 2bYg==
MIME-Version: 1.0
X-Received: by 10.180.74.131 with SMTP id t3mr31059602wiv.23.1363232994254; Wed, 13 Mar 2013 20:49:54 -0700 (PDT)
Received: by 10.194.11.71 with HTTP; Wed, 13 Mar 2013 20:49:53 -0700 (PDT)
Date: Wed, 13 Mar 2013 23:49:53 -0400
Message-ID: <CAMm+Lwge7VBNWvWG01UN4j9=1nB+b8prusSVxgOpOcNLbZT8Sg@mail.gmail.com>
From: Phillip Hallam-Baker <hallam@gmail.com>
To: websec <websec@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"
Subject: [websec] Session Continuation = Session Bound State?
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Mar 2013 03:49:56 -0000

The main substantive query that seemed to be raised in the meeting was
what we are going to call this session continuation thing. I am not
that worried about confusion with HTTP-Auth. Folk who know, know.

But one of the objectives here is to replace cookies. So choosing a
name that positions the spec as a successor to authentication cookies
is actually quite important.


How about Session Bound State as the term of art?

-- 
Website: http://hallambaker.com/