Subject: Re: [Unbearable] [Internet-Drafts] Include-Referer-Token-Binding-ID header meaningful beyond HTTP 302/1? (#10)

From: John Bradley <[email-masked]>
Date: Wed, 1 Jul 2015 14:11:34 -0300

We should really be having this discussion on the list:)

I think that the second option is probably more flexible.  
It would make no difference for the simple use case of a authn request,  however there may be cases where JS is loaded from a origin that may want to include it’s origin token binding for some calls and not others.

The header approach seems more like a all or nothing proposition.

Perhaps someone more familiar with proser based JS could give us a more informed opinion.

John B.
> On Jul 1, 2015, at 11:30 AM, Brian Campbell <[email-masked]> wrote:
> 
> So just to recap (maybe stating the obvious) - I was imagining the above auto-post would have the Include-Referer-Token-Binding-ID header in the response and that would instruct the browser to send the referred_token_binding in the POST to https://idp.com/oauth-authz <https://idp.com/oauth-authz> which is at a host/domain that's different than the one (say https://rp.com/stuff <https://rp.com/stuff>) that served the content. So that'd be:
> 
>   HTTP/1.1 200 OK
>   Content-Type: text/html;charset=UTF-8
>   Cache-Control: no-cache, no-store
>   Include-Referer-Token-Binding-ID: true
> 
>   <html>
>    <head><title>Sending you to your identity provider</title></head>
>    <body onload="javascript:document.forms[0].submit()">
>     <form method="post" action="https://idp.com/oauth-authz">
>       <input type="hidden" name="client_id" value="abc9er"/>
>       <input type="hidden" name="response_type" value="code"/>
>       <input type="hidden" name="scope" value="openid profile"/>
>       <input type="hidden" name="etc" value="etc"/>
>     </form>
>    </body>
>   </html>
> Whereas @balfanz <https://github.com/balfanz> imagined that the indicator be directly on the <form> element itself. That would look more like:
> 
>   HTTP/1.1 200 OK
>   Content-Type: text/html;charset=UTF-8
>   Cache-Control: no-cache, no-store
> 
>   <html>
>    <head><title>Sending you to your identity provider</title></head>
>    <body onload="javascript:document.forms[0].submit()">
>     <form method="post" action="https://idp.com/oauth-authz" include-referer-token-binding="true">
>       <input type="hidden" name="client_id" value="abc9er"/>
>       <input type="hidden" name="response_type" value="code"/>
>       <input type="hidden" name="scope" value="openid profile"/>
>       <input type="hidden" name="etc" value="etc"/>
>     </form>
>    </body>
>   </html>
> I don't have a preference between the two (or any other alternative that might come up). I'm just pushing to have the eventual solution allow for it somehow.
> 
> —
> Reply to this email directly or view it on GitHub <https://github.com/TokenBinding/Internet-Drafts/issues/10#issuecomment-117695361>.
>