Subject: Re: [Wish] Authentication for resource url

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 7 Oct 2021 17:09:33 -0500

Just chiming in for one point -

On Wed, Sep 8, 2021 at 12:27 PM Juliusz Chroboczek <[email-masked]> wrote:

> > I think we have the following options:
> >  - Use the same mechanism/info as the initial request to the whip url
> (i.e.
> > sending the Authentication header with the same bearer token)
> >  - Returning a randomized opaque unique url
> >  - Allow using both?
>
> I think this is better left unspecified in the normative part of the
> document, but should be explained in detail in the Security Considerations
> section or in an informative appendix.
>

I can't speak to where the explanation should be, but Security
Considerations are pretty much always normative. If you're thinking
"informative", you'd surprise fewer people if you put that in an appendix
(marked "informative").

IMO, of course.

Best,

Spencer

> -- Juliusz
>
> --
> Wish mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/wish
>