Re: [weirds] Alissa Cooper's Discuss on draft-ietf-weirds-using-http-14: (with DISCUSS)

[Richard Barnes <[e-mail]>]

On Tue, Oct 28, 2014 at 4:17 PM, Alissa Cooper <[e-mail]> wrote:

> Alissa Cooper has entered the following ballot position for
> draft-ietf-weirds-using-http-14: Discuss
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/draft-ietf-weirds-using-http/
>
>
>
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
>
> = Section 5.6 =
> "When responding to queries, it is RECOMMENDED that servers use the
>    Access-Control-Allow-Origin header field, as specified by
>    [W3C.CR-cors-20130129].  As the use of RDAP is for public resources,
>    a value of "*" is suitable for most cases."
>
> What is the use case for cross-site RDAP queries?
>

This seems pretty obvious to me; see, e.g., https://who.is/


Also, I am confused by the claim in the second sentence. The message that
> I got from draft-ietf-weirds-rdap-sec and draft-ietf-weirds-json-response
> is that one of the motivations for using HTTP for RDAP was that its
> authentication features could be leveraged to provide tiered access to
> data on the server, such that some of the data would not be public but
> would be restricted to specific users (from
> draft-ietf-weirds-json-response, Appendix A.1: "In many use cases, it is
> necessary to hide or obscure the information of a registrant or contact
> due to policy or other operational matters."). So it seems like if
> cross-site requests are justified at all, there should be some text here
> explaining when that might be the case and when not.
>

I agree that some clarification could be useful, in light of the fact that
not *all* RDAP data will be public.

In particular, I note that cross-origin requests (if authorized) will be
sent with the user's cookies.  So RDAP server operators should keep in mind
that if they allow cross-origin requests, then they might expose
access-controlled information to origins that might not be authorized.  The
right mitigation is probably to suggest checking the Origin header and
using that as a secondary control.

--Richard