Subject: disallowing userinfo in http and https URIs

From: "Roy T. Fielding" <[email-masked]>
Date: Tue, 27 Jul 2010 18:59:11 -0700

FYI, I added the following paragraph for draft 11 as part of addressing
ticket #159 in

  http://trac.tools.ietf.org/wg/httpbis/trac/changeset/877

p1, sec 2.6.1:  added paragraph:

   The URI generic syntax for authority also includes a deprecated
   userinfo subcomponent ([RFC3986], Section 3.2.1) for including
   user authentication information in the URI. The userinfo
   subcomponent (and its "@" delimiter) MUST NOT be used in an
   "http" URI. URI reference recipients SHOULD parse for the
   existence of userinfo and treat its presence as an error,
   likely indicating that the deprecated subcomponent is being used
   to obscure the authority for the sake of phishing attacks.

I'm pretty sure that this topic was discussed before on list, though
I can't find the thread at the moment.  Please let us know if you
disagree with this change.

....Roy

---

From: Adrien de Croy <[email-masked]>
Date: Wed, 28 Jul 2010 14:05:58 +1200

I'm all for removing it, but isn't that the only way that IE will auth 
to an FTP server via an HTTP proxy?  We see these URIs all the time.

Regards

Adrien

---

From: "William A. Rowe Jr." <[email-masked]>
Date: Tue, 27 Jul 2010 21:59:18 -0500

> to an FTP server via an HTTP proxy?  We see these URIs all the time.

That would be an ftp: uri, no?

---

From: Adrien de Croy <[email-masked]>
Date: Wed, 28 Jul 2010 15:23:22 +1200

ah ok, now I see the significance of the quotes..

---

From: Mark Baker <[email-masked]>
Date: Wed, 28 Jul 2010 00:02:46 -0400

Hi Roy,

> disagree with this change.

FWIW, we use this construct in the Akara HTTP server project, but
those http URIs are only ever found in configuration files, never on
the wire.

The use of userinfo on the wire is obviously a security nightmare, and
I welcome bold warnings about its use, but I wonder if requiring they
be treated as erroneous is necessary, especially when there's so many
existing agents which silently ignore it (just tested Firefox 3.6.8,
latest Chrome beta, wget), or support it by initiating basic auth
(curl).

Mark.

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 28 Jul 2010 10:21:58 +0200

> those http URIs are only ever found in configuration files, never on
Right. I personally find this use case quite compelling.
> latest Chrome beta, wget), or support it by initiating basic auth
Either this, or clarify that the userinfo part is not allowed in HTTP 
(but maybe used in other contexts).
It would probably be safer to prohibit userinfo use on the wire.

---

From: Julian Reschke <[email-masked]>
Date: Wed, 28 Jul 2010 10:30:03 +0200

On 28.07.2010 10:21, Alexey Melnikov wrote:
> ...
> ...

On the wire it would be in a different place anyway, right?

As far as I understand, this is really about the URI syntax only...

---

From: Reto Bachmann-Gmür <[email-masked]>
Date: Wed, 28 Jul 2010 11:16:14 +0200

> As far as I understand, this is really about the URI syntax only...

It might be transferred over the wire in hypertext links, where it is
clearly problematic.

I am however wondering if for https the userinfo section could be used
to encode/hash the public key of the linked party allowing additional
security or trust in "self-signed" certificates (by a p2p chain of
trust). This would integrate Tyler Close's httpsy[1] idea into https.

Cheers,
reto

1. http://www.waterken.com/dev/YURL/httpsy/

---

From: "Martin J. Dürst" <[email-masked]>
Date: Wed, 28 Jul 2010 19:57:26 +0900

> latest Chrome beta, wget), or support it by initiating basic auth

I have only very limited experience with userinfo. However, the one I 
have doesn't suggest it gets disallowed. There is not much difference 
between sending passwords in clear in email as:

go to page http://foo.org/bar
user: us_only
password: secret

and:

go to page http://us_only:[email-masked]/bar

when people are aware of the fact that this page isn't for everybody's 
eyes. However, the later is way more practical.

Regards,    Martin.

-- 
#-# Martin J. Dürst, Professor, Aoyama Gakuin University
#-# http://www.sw.it.aoyama.ac.jp   mailto:[email-masked]

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 29 Jul 2010 12:34:07 +0200

That may be true, but pretty much every client implementation disallows them, and have no plans for changing.

So, I think the only question is whether we completely disallow them, or allow them syntactically in the ABNF but disallow them on the wire in prose. 

Cheers,

On 28/07/2010, at 12:57 PM, Martin J. Dürst wrote:

> I have only very limited experience with userinfo. However, the one I have doesn't suggest it gets disallowed. There is not much difference between sending passwords in clear in email as:
> 
> when people are aware of the fact that this page isn't for everybody's eyes. However, the later is way more practical.
> 
> Regards,    Martin.
> 
> -- 

--
Mark Nottingham     http://www.mnot.net/