Subject: Fwd: Comment on "Signing HTTP Messages"

From: Richard Gibson <[email-masked]>
Date: Tue, 30 Jan 2018 18:40:21 +0000

-------- Forwarded Message --------
Subject:	Comment on "Signing HTTP Messages"
Date:	Mon, 29 Jan 2018 21:55:23 -0500
From:	Richard Gibson <[email-masked]> <mailto:[email-masked]>
To:	[email-masked] <mailto:[email-masked]>, [email-masked] <mailto:[email-masked]>

https://tools.ietf.org/html/draft-cavage-http-signatures-09#section-2.2 <https://tools.ietf.org/html/draft-cavage-http-signatures-09#section-2.2> 
specifies the following:

> If any of the parameters listed above are erroneously duplicated in 
the associated header field, then the last parameter defined MUST be used.

This may expose a client security vulnerability for attacks analogous to 
HTTP header injection. Is there a compelling reason not to reject 
requests that specify the same parameter more than once?

> Any parameter that is not recognized as a parameter, or is not 
well-formed, MUST be ignored.

This will almost certainly limit future changes, since legacy clients 
won't implement desired behavior changes from new parameters _and_ will 
fail to signal that inability. Is there a compelling reason not to 
reject requests that specify unknown parameters?