Subject: Re: [CDNi] URI Signing Logging Codes

From: Phil Sorber <[email-masked]>
Date: Mon, 11 Mar 2019 16:45:29 -0600

On Wed, Jan 23, 2019 at 12:06 PM Chris Lemmons <[email-masked]> wrote:

> It looks like the Logging Codes in §4.5 are a bit behind some other
> recent changes. Some notes:
>
> 403 refers to "Regular Expression" enforcement, but it's possible a
> different container was used. If this is to refer just to regexen,
> that's fine, but then we'd need a code for mismatched other container.
> I suspect this should just say, "cdniuc enforcement".
>

It appears this is very old text. Also, there seem to be at least a couple
places we assumed Regex when other options are available.

>
> These claims can be used for enforcement, but don't have an associated
> code (with examples):
>   sub: The subject isn't authorized for content on the dCDN.
>   aud: The token was presented to the wrong dCDN.
>   jti: A token is reused.
>   cdniv: An unsupported token version number is presented.
>   cdnicrit: An unsupported extension is used.
>

Yes, these should be added.

>
> Additionally, although the 500 code can be used for a malformed URI,
> it's unclear what should be logged when the claim formulation is
> unacceptable, for example, a negative cdnistd claim or a cdnistt
> without a cdniets claim. In fact, it's not entirely clear from the
> text whether a claim formulated like this MAY, MUST, or MUST NOT be
> rejected.
>
> And if a token is rejected for a reason not listed, presumably as a
> result of an extension, what number should be logged? Should we have a
> "catch-all"?
>

I think 500 is the catch-all. As in, "I couldn't understand this."

>
> What if a token is invalid for multiple reasons? Which code takes
> precedence?
>

I don't think that's particularly important. I think whatever you first
find invalid is what you should log. There is no reason to continue to
check other claims if you have found something to be invalid. If this is
for diagnostics then once you correct one thing, the next problem will show
itself.

>
> _______________________________________________
> CDNi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cdni
>