Subject: [Acme] Explicitly forbid to answer GET requests for account info

From: Jörn Heissler <[email-masked]>
Date: Sun, 4 Mar 2018 12:57:04 +0100

Hi,

another PR that slightly changes meaning (SHOULD NOT -> MUST NOT):
https://github.com/ietf-wg-acme/acme/pull/407

Section "Request Authentication" says:
"Servers MUST NOT respond to GET requests for resources that might be
considered sensitive. Account resources are the only sensitive resources
defined in this specification."

I agree with the "MUST NOT" here as account contains e.g. my contact data.
Therefore section "Account Information" should also says "MUST NOT":
"Servers MUST NOT respond to GET requests for account resources..."

Cheers
Joern Heissler

---

From: Daniel McCarney <[email-masked]>
Date: Mon, 5 Mar 2018 09:30:48 -0500

Thanks Joern, merged.

On Sun, Mar 4, 2018 at 6:57 AM, Jörn Heissler <[email-masked]>
wrote:

> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>
>