Subject: Re: [CDNi] I-D Action: draft-ietf-cdni-uri-signing-10.txt

From: Leif Hedstrom <[email-masked]>
Date: Tue, 1 Nov 2016 09:24:40 -0600

> On Oct 26, 2016, at 10:09 AM, Phil Sorber <[email-masked]> wrote:
> 
> I added your text changes to the PR.
> 
> As far as ignoring extra claims, it was for third parties. I am rethinking this though. Leif expressed some concerns about processing performance if we allowed free form content. It seems like ignoring unknown claims is of marginal value, but it had several downsides.

My thinking is that we should make efforts to clamp down specifications on what is acceptable (and required) JSON and claims here. Such that someone could write a really fast, simplified JWT parser that only handles the cases we must support, nothing more, nothing less.

Cheers,

— Leif

---

From: Phil Sorber <[email-masked]>
Date: Wed, 02 Nov 2016 18:56:20 +0000

Ok, I've reverted to the "reject" wording.

On Tue, Nov 1, 2016 at 9:25 AM Leif Hedstrom <[email-masked]> wrote:

> > As far as ignoring extra claims, it was for third parties. I am
> rethinking this though. Leif expressed some concerns about processing
> performance if we allowed free form content. It seems like ignoring unknown
> claims is of marginal value, but it had several downsides.
>
>
> My thinking is that we should make efforts to clamp down specifications on
> what is acceptable (and required) JSON and claims here. Such that someone
> could write a really fast, simplified JWT parser that only handles the
> cases we must support, nothing more, nothing less.
>
> Cheers,
>
> — Leif
>
>