Here's a thought:
signed_content="request,query,body"
If not included, it defaults to "request,query". It's non-breaking (except for
the implied removal of bodyhash), allows for either body or query content to be
omitted from the signature, and looks less ugly than bodyhash=true. If you
prefer, the value of this attribute could be one of a predefined string
(request_query, request_query_body, request, etc.) rather than individual
parsed elements.
On Feb 7, 2011, at 6:26 PM, Eran Hammer-Lahav wrote:
> Yeah...
>
> I struggled with that. There is no reason to include the body hash with the
> request other than to indicate a body hash is included in the normalized
> request string. It's just that an attribute like 'bodyhash=true' is so ugly...
>
> I'm still thinking about this.
>
> EHL
>
>> -----Original Message-----
>> From: Skylar Woodward [mailto:sky...@kiva.org]
>> Sent: Monday, February 07, 2011 9:25 AM
>> To: Eran Hammer-Lahav; OAuth WG
>> Subject: Re: [OAUTH-WG] draft-hammer-oauth-v2-mac-token-02
>>
>> On body-hash...
>>
>> Having completed a trial implementation, it seems redundant, and
>> potentially problematic, to include the body-hash in the Authentication
>> header. The danger is that implementors may neglect to recalculate the hash
>> themselves, reusing the value (even if incorrect) provided by the client. Why
>> not just require the provider to calculate this and validate it by comparing
>> the
>> final signature? This way it's clearer for everyone what the expectations are
>> in validating the signature.
>>
>> I propose either a flag (eg, usebodyhash="1") or an algorithm
>> (bodyhashalgorithm="sha1"). If this parameter was provided, the correct
>> hash would be added to the base string for signing. If omitted (or set
>> false?)
>> then an empty string is used for base string element #4.
>>
>>
>> On including parameters for signing...
>>
>> I'd retract my suggestion that we'd include parameter-hash in the header.
>> Instead, I would suggest making parameters optional in calculating the
>> signature using a flag as with bodyhash. Providers could require including
>> parameters if so desired. Parameters could be included as currently defined,
>> or with a hash method similar to entity-body (which I find both simpler and
>> more congruent).
>>
>> Again, the goal in making query parameters optional is to allow providers to
>> make signature calculation as simple as possible for clients (so much as it
>> is in
>> line with the security requirements of the provider) and avoid complexities
>> in
>> implementation such as those that tripped up OAuth 1.
>>
>>
>>
>> On Jan 22, 2011, at 2:09 AM, Eran Hammer-Lahav wrote:
>>
>>> http://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-02
>>>
>>> New version includes the following changes:
>>>
>>> o Added body-hash support.
>>> o Updated OAuth 2.0 reference to -12 and added token type registration
>> template.
>>> o Removed error and error URI attributes (codes were just a duplication
>> of the HTTP status codes).
>>>
>>> Feedback would be greatly appreciated.
>>>
>>> EHL
>>>
>>>
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
>
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
