Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Include-Referer-Token-Binding-ID header meaningful beyond HTTP 302/1? (#10)

From: Brian Campbell <[email-masked]>
Date: Fri, 13 May 2016 15:01:12 -0700

At the meeting in Buenos Aires there seemed to be pretty wide consensus that the Include-Referer-Token-Binding-ID only having meaning for 30x status codes was sufficient for the scope of the draft-ietf-tokbind-https document. And that fetch() or other things that might use TB could define their own semantics for it if/when necessary. 

As of draft -03 the Include-Referer-Token-Binding-ID header is defined to have meaning for 301, 302, 303, 307 or 308. So transmitting an authentication request to the token provider/IDP via the HTTP POST   method could be achieved by the token consumer/RP sending an auto-submitting form post with the request back to itself and responding to that with a 307 directing the browser to resubmit the POST data to the token provider/IDP. It's a little ugly but will work with only the functionally provided by draft-ietf-tokbind-https.

So with all that said, I think this issue can be closed now. 

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/issues/10#issuecomment-219170018