Subject: [Unbearable] HTTPSTB: more explicitly state that referred token binding only sent on redirect request (issue #34)

From: Brian Campbell <[email-masked]>
Date: Mon, 16 May 2016 12:05:48 -0600

copied content from
https://github.com/TokenBinding/Internet-Drafts/issues/34 below

On my initial reading of draft-ietf-tokbind-https-03 it was not immediately
clear to me that the referred token binding was to be sent to the Token
Provider only on the request resulting from the 30x redirect from the the
Token Consumer with the Include-Referer-Token-Binding-ID and not on any
subsequent requests to the Token Provider. I asked about this in BA, though
the minutes don't fully capture it
<https://datatracker.ietf.org/doc/minutes-95-tokbind/>, and it was
explained (thank you Andrei et al) that the referred token binding is only
sent once on the redirect request and not again.

After having it explained and on reading it again, the 3rd paragraph of
section 3.3 does say that the referred token binding is sent "on the
redirect request." So the behavior is stated in the text but I do believe
the draft would be more clear if it explicitly stated that the referred
token binding is sent only on the request resulting from the redirect and
not on any subsequent requests to the Token Provider.

Thanks!