Subject: OAuth Bearer authentication - for proxies?

From: Mark Nottingham <[email-masked]>
Date: Sat, 24 Dec 2011 08:46:45 -0500

The OAUTH WG is creating a new authentication scheme for bearer tokens:
  http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-15

During review, I wondered whether this might be a suitable scheme for proxies; the draft doesn't currently specify it as such, and our list of considerations for new schemes asks them to consider this.

Do any of the proxy implementers on the list have thoughts about this / possible interest in it?

Cheers,

--
Mark Nottingham
http://www.mnot.net/

---

From: Amos Jeffries <[email-masked]>
Date: Sun, 25 Dec 2011 19:21:32 +1300

>   http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-15

 Reading section 2.3, it appears this method of transferring the 
 credentials is open to replay attacks when caching TLS middleware is 
 present. I believe this spec should mandate cache controls on responses 
 using that method. Otherwise a lot of HTTP compliant middleware will 
 feel free to store and supply the protected response to later replay 
 attacks.

> During review, I wondered whether this might be a suitable scheme for
> proxies; the draft doesn't currently specify it as such, and our list
> of considerations for new schemes asks them to consider this.
>

 I think it would be a good idea to prepare for. Quite a few admin these 
 days consider transit to be a service that needs authenticating as much 
 as any origin server resource. It might even encourage progress on the 
 TLS proxy connection developments we have been waiting for.

 AYJ

---

From: Julian Reschke <[email-masked]>
Date: Sun, 25 Dec 2011 11:14:32 +0100

On 2011-12-25 07:21, Amos Jeffries wrote:
 > ...

...you may want to send this to the OAuth WG...

Best regards, Julian

---

From: Amos Jeffries <[email-masked]>
Date: Sat, 31 Dec 2011 16:14:42 +1300

re-posting for cc to OAuth WG

On 25/12/2011 7:21 p.m., Amos Jeffries wrote:
> present. I believe this spec should mandate cache controls on 
> responses using that method. Otherwise a lot of HTTP compliant 
> middleware will feel free to store and supply the protected response 
> to later replay attacks.
>
>
> I think it would be a good idea to prepare for. Quite a few admin 
> these days consider transit to be a service that needs authenticating 
> as much as any origin server resource. It might even encourage 
> progress on the TLS proxy connection developments we have been waiting 
> for.
>
> AYJ
>
>