Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Remove requirement to terminate connections (#80)

From: Piotr Sikora <[email-masked]>
Date: Mon, 14 Nov 2016 02:21:01 -0800

+1

However, I disagree with your choice regarding the status code.

Per [RFC7235, sec. 3.1. 401 Unauthorized](https://tools.ietf.org/html/rfc7235#section-3.1):

    The 401 (Unauthorized) status code indicates that the request has not
    been applied because it lacks valid authentication credentials for
    the target resource.  The server generating a 401 response MUST send
    a WWW-Authenticate header field (Section 4.1) containing at least one
    challenge applicable to the target resource.

There is no way response to broken Token Binding should have WWW-Authenticate header.

I suggest use of the generic 400 Bad Request instead, since this is indeed an invalid request.

Per [RFC7231, sec. 6.5.1. 400 Bad Request](https://tools.ietf.org/html/rfc7231#section-6.5.1):

    The 400 (Bad Request) status code indicates that the server cannot or
    will not process the request due to something that is perceived to be
    a client error (e.g., malformed request syntax, invalid request
    message framing, or deceptive request routing).

Coincidentally, this is also the status code I'm using in the [NGINX module for Token Binding](https://github.com/google/ngx_token_binding).

Also, `MUST` or `SHOULD` would be better than `might be`, but that might be wrong document to include this requirement.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/pull/80#issuecomment-260298589

---

From: Subodh Iyengar <[email-masked]>
Date: Mon, 14 Nov 2016 12:44:35 -0800

+1

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/pull/80#issuecomment-260456938

---

From: Brian Campbell <[email-masked]>
Date: Mon, 14 Nov 2016 13:38:52 -0800

Agree that 401 isn't right. 400 works but what about 403? I'm honestly not sure so asking. 

And yes, the status code definitely needs to be in the HTTPSTB draft as well. And that's where the normative `MUST` or `SHOULD` would go.  

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/pull/80#issuecomment-260471019

---

From: Andrei-Popov <[email-masked]>
Date: Wed, 16 Nov 2016 23:54:10 -0800

Addressed in TBPROTO-11 and HTTPSTB-7

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/pull/80#issuecomment-261178946