Subject: [Unbearable] Description of first-party scenarios missing from draft-ietf-tokbind-https

From: Mike Jones <[email-masked]>
Date: Thu, 30 Jun 2016 01:49:58 +0000

The abstract of draft-ietf-tokbind-https says:

   We describe both _first-party_ as well as _federated_ scenarios.  In
   a first-party scenario, an HTTP server issues a security token (such
   as a cookie) to a client, and expects the client to send the security
   token back to the server at a later time in order to authenticate.
   Binding the token to the TLS connection between client and server
   protects the security token from theft, and ensures that the security
   token can only be used by the client that it was issued to.

And indeed, Section 3 and Section 4.4 do a great job describing federated scenarios.

Reading the spec, I expected there to be a parallel section to Section 3 before it called something like "First-Party Use Cases".  This would describe how to use Token Binding for first-party use cases, such as cookies or OAuth refresh tokens.  But that section is missing, despite the abstract saying that it would exist.

Can this get written soon?

                                                                Thanks,
                                                                -- Mike

---

From: [email-masked]
Date: Thu, 30 Jun 2016 14:56:04 -0600

Quoting Mike Jones <[email-masked]>:

> Reading the spec, I expected there to be a parallel section to  
> Section 3 before it called something like "First-Party Use Cases".   
> This would describe how to use Token Binding for first-party use  
> cases, such as cookies or OAuth refresh tokens.  But that section is  
> missing, despite the abstract saying that it would exist.
>

issue submitted.

   HTTPSTB: first-party sec token use cases #43
   https://github.com/TokenBinding/Internet-Drafts/issues/43

I will take a stab at it.

=JeffH