Subject: CAP: VCAR - limiting READ

From: Doug Royer <[email-masked]>
Date: Mon, 19 Nov 2001 11:06:26 -0700

For security reasons, a site may wish a CUA to only see GRANT and DENY
values for which it has access. So I propose an additional paragraph
to section "2.4.4 Access Rights - Summary":

A CS may limit the results sent to a CUA in reply to a METHOD READ
on a VCAR to a set that applies to the current session identity.
That is if user 'Joe' is the current session identity, then when
'Joe' asks to see the VCARs, the CS might only return a VCAR that effects
'Joe'. In this way 'Joe' can not see who does have other access.

---

From: "John Stracke" <[email-masked]>
Date: Mon, 19 Nov 2001 17:27:31 -0500

>values for which it has access.

This sounds like a good idea to me.  Of course, a CS could probably get 
away with doing it even if it's not in the spec (it probably won't break 
interop); but better to document it.

/==============================================================\
|John Stracke                   |Principal Engineer            |
[email-masked]  |Incentive Systems, Inc.       |
|http://www.incentivesystems.com|My opinions are my own.       |
|==============================================================|
|"HTTP is what happens in the absence of good design." -- Keith|
|Moore                                                         |
\==============================================================/