Subject: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: more explicitly state that referred token binding only sent on redirect request (#34)

From: Brian Campbell <[email-masked]>
Date: Mon, 16 May 2016 10:59:31 -0700

On my initial reading of draft-ietf-tokbind-https-03 it was not immediately clear to me that the referred token binding was to be sent to the Token Provider only on the request resulting from the 30x redirect from the the Token Consumer with the Include-Referer-Token-Binding-ID and not on any subsequent requests to the Token Provider. I asked about this in BA, [though the minutes don't fully capture it](https://datatracker.ietf.org/doc/minutes-95-tokbind/), and it was explained (thank you Andrei et al) that the referred token binding is only sent once on the redirect request and not again. 

After having it explained and on reading it again, the 3rd paragraph of section 3.3 does say that the referred token binding is sent "on the redirect request." So the behavior is stated in the text but I do believe the draft would be more clear if it explicitly stated that the referred token binding is sent only on the request resulting from the redirect and not on any subsequent requests to the Token Provider. 

Thanks!

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/issues/34