Subject: Explicit instructions on use of fragment in request URI

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 21 Apr 2010 23:19:58 -0700

This came up in the OAuth WG. One of the flows used to obtain a token relies on the fact that browsers don't sent the fragment over to the server and uses it to encoded credentials visible only to the browser (server provides them via a redirect Location header). I was asked what stops the browser from sending the fragment.

I spent some time trying to find where 2616 forbids including the fragment and the best I came up with is from 3986:

   the fragment identifier is separated
   from the rest of the URI prior to a dereference, and thus the
   identifying information within the fragment itself is dereferenced
   solely by the user agent, regardless of the URI scheme.

Mark pointed me to the definition of request-URI which is abs_path or absoluteURI from 2396, which in turn do not allow a fragment.

Would it be possible to make this easier?

Something like "the request URI MUST NOT include a fragment component"... :-)

EHL

---

From: Julian Reschke <[email-masked]>
Date: Thu, 22 Apr 2010 08:38:11 +0200

> Something like "the request URI MUST NOT include a fragment component"... :-)

Not convinced.

a) Has this been a problem somewhere?

b) Making a BCP14 requirement on something the syntax doesn't allow in 
the first place doesn't feel right to me. If the request contains a 
fragment component, it's invalid. Period.

Best regards, Julian

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 21 Apr 2010 23:49:09 -0700

I'm not looking for a MUST NOT. But it would be nice for the spec to say "btw, you can't use fragments here".

I always knew fragments are not allowed, but when asked, I couldn't show where that's defined. And because HTTP doesn't make it easy, OAuth has to make developers aware of that.

EHL

> -----Original Message-----
> From: Julian Reschke [mailto:[email-masked]]
> Sent: Wednesday, April 21, 2010 11:38 PM
> To: Eran Hammer-Lahav
> Cc: HTTP Working Group ([email-masked])
> Subject: Re: Explicit instructions on use of fragment in request URI
> 
> > This came up in the OAuth WG. One of the flows used to obtain a token
> relies on the fact that browsers don't sent the fragment over to the server
> and uses it to encoded credentials visible only to the browser (server
> provides them via a redirect Location header). I was asked what stops the
> browser from sending the fragment.
> >
> > I spent some time trying to find where 2616 forbids including the fragment
> and the best I came up with is from 3986:
> >
> > Mark pointed me to the definition of request-URI which is abs_path or
> absoluteURI from 2396, which in turn do not allow a fragment.
> >
> b) Making a BCP14 requirement on something the syntax doesn't allow in the
> first place doesn't feel right to me. If the request contains a fragment
> component, it's invalid. Period.
> 
> Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Thu, 22 Apr 2010 08:58:10 +0200

On 22.04.2010 08:49, Eran Hammer-Lahav wrote:
> ...

Still trying to understand the issue.

The ABNF doesn't allow the fragment here; is that really so hard to spot?

Best regards, Julian

---

From: Daniel Stenberg <[email-masked]>
Date: Thu, 22 Apr 2010 09:26:32 +0200 (CEST)

On Wed, 21 Apr 2010, Eran Hammer-Lahav wrote:

> Something like "the request URI MUST NOT include a fragment component"...

Related: curl included the fragment in HTTP requests for something like 10 
years until we fixed that bug, but it basically _never_ caused a problem (in a 
report back to us at least). Obviously, servers tend to just skip/ignore the 
fragment part if received.

-- 

  / daniel.haxx.se

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 22 Apr 2010 00:26:13 -0700

It's not intuitive for the occasional real to figure out that absolute-URI doesn't include fragment. Now that it was pointed out to me, it seems pretty straight forward. I think it will help developer avoid this mistake (of sending a fragment), but then again, I'm not sure how many of them will read the spec that closely. I am going to make it clear in the OAuth spec because sending the fragment is a security risk.

EHL

> Sent: Wednesday, April 21, 2010 11:58 PM
> To: Eran Hammer-Lahav
> > I always knew fragments are not allowed, but when asked, I couldn't show
> where that's defined. And because HTTP doesn't make it easy, OAuth has to
> make developers aware of that.
> > ...
>