Re: [Wish] Authentication for resource url

[Lorenzo Miniero <[e-mail]>]

On Wed, 8 Sep 2021 16:30:58 +0200
Sergio Garcia Murillo <[e-mail]> wrote:

> Hi all,
> 
> Lorenzo asked me a question regarding how the authentication of the
> resource url returned on the location header (the one in which the
> DELETE and PATCH requests are sent) and I am not sure about the right
> answer.
> 
> I think we have the following options:
>  - Use the same mechanism/info as the initial request to the whip url
> (i.e. sending the Authentication header with the same bearer token)
>  - Returning a randomized opaque unique url
>  - Allow using both?
> 
> The randomized opaque url is something that the server is always free
> to implement, but should we explicitly  state in the draft that the
> client must send the same authentication header on those requests?
> 
> Best regards
> Sergio


Hi all,

it makes sense to me that the same token should be used for both
addresses, but I guess in some implementations it may be problematic in
case (as it will often happen) those addresses are actually handled by
different servers. In general, I think the Authorization section of the
document should be made a bit clearer, as it's not explained whether
the same token is required for the PATCH requests to send trickle
candidates too, for instance (the obvious answer for me being "yes",
but I think making it explicit in the draft won't harm).

Lorenzo

-- 
I'm getting older but, unlike whisky, I'm not getting any better
https://twitter.com/elminiero