Re: [Wish] Authentication for resource url

[Sergio Garcia Murillo <[e-mail]>]

The second method (returning an unique url) could be detailed on the
security considerations, but sending the same authentication bearer token
in both requests should be in the normative part.

Somehow, I don't like any of both ideas, sending the same token in both
requests doesn't feel appropriate as the idea is that the whip endpoint and
the whip resource could be in different servers, so the token for the
PATH/DELETE request is most probably irrelevant for the media server.

But returning an unique url doesn't seem a very secure idea. Anyway, if
anyone could get access to the resource url. On the other hand, if an
attacker has access to the url in the http response, it would most probably
have access to the data in the request (i.e. the token).

What do you think?
Sergio

El mié, 8 sept 2021 a las 19:27, Juliusz Chroboczek (<[e-mail]>)
escribió:

> > I think we have the following options:
> >  - Use the same mechanism/info as the initial request to the whip url
> (i.e.
> > sending the Authentication header with the same bearer token)
> >  - Returning a randomized opaque unique url
> >  - Allow using both?
>
> I think this is better left unspecified in the normative part of the
> document, but should be explained in detail in the Security Considerations
> section or in an informative appendix.
>
> -- Juliusz
>