This errata looks correct to me, we should confirm it. ________________________________ From: RFC Errata System <rfc-edi...@rfc-editor.org> Sent: Wednesday, July 31, 2024 9:26 AM To: m...@microsoft.com <m...@microsoft.com>; ve7...@ve7jtb.com <ve7...@ve7jtb.com>; n-sakim...@nri.co.jp <n-sakim...@nri.co.jp>; debcool...@gmail.com <debcool...@gmail.com>; paul.wout...@aiven.io <paul.wout...@aiven.io>; hannes.tschofe...@arm.com <hannes.tschofe...@arm.com>; rifaat.s.i...@gmail.com <rifaat.s.i...@gmail.com> Cc: prkassel...@gmail.com <prkassel...@gmail.com>; oauth@ietf.org <oauth@ietf.org>; rfc-edi...@rfc-editor.org <rfc-edi...@rfc-editor.org> Subject: [OAUTH-WG] [Technical Errata Reported] RFC7519 (8060)
The following errata report has been submitted for RFC7519, "JSON Web Token (JWT)". -------------------------------------- You may review the report below and at: https://www.rfc-editor.org/errata/eid8060 -------------------------------------- Type: Technical Reported by: Pieter Kasselman <prkassel...@gmail.com> Section: 7.2 Original Text ------------- 5. Verify that the resulting JOSE Header includes only parameters and values whose syntax and semantics are both understood and supported or that are specified as being ignored when not understood. Corrected Text -------------- 5. Verify that the resulting JOSE Header includes only parameters and values whose syntax and semantics are both understood and supported or that are specified as being ignored when not understood. If the JWT is a JWS, the steps specified in RFC7515 takes precedence when validating JOSE Header parameters. Notes ----- Validation step 5 in section 7.2 of RFC 7519 states that header parameters should only be ignored if they are explicitly specified as needing to be ignored. This is contrary to step 7 in section 7.2 which requires that the processing rules of RFC 1515 be used if the JWT is a JWS (defined in RFC 1515). RFC 7515 does not include any special provisions for only ignoring header parameters if they are specified as being ignored, but instead requires all header parameters to be ignored if they are not understood (repeated below for convenience). "Unless listed as a critical Header Parameter, per Section 4.1.11, all Header Parameters not defined by this specification MUST be ignored when not understood." A discussion with the authors at IETF 120 confirmed that all header parameters that are not understood must be ignored. The proposed errata aims to clarify that if the JWT is a JWS, the processing rules of RFC 7151 should apply (including ignoring header parameters that are not understood). This is consistent with point 7.2, which requires that RFC 7515 [JWS] rules applies and avoids the impression that a new requirement on when parameters are ignored is being introduced in (i.e. the need to be explicitly defined as needing to be ignored). Instructions: ------------- This erratum is currently posted as "Reported". (If it is spam, it will be removed shortly by the RFC Production Center.) Please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party will log in to change the status and edit the report, if necessary. -------------------------------------- RFC7519 (draft-ietf-oauth-json-web-token-32) -------------------------------------- Title : JSON Web Token (JWT) Publication Date : May 2015 Author(s) : M. Jones, J. Bradley, N. Sakimura Category : PROPOSED STANDARD Source : Web Authorization Protocol Stream : IETF Verifying Party : IESG _______________________________________________ OAuth mailing list -- oauth@ietf.org To unsubscribe send an email to oauth-le...@ietf.org
_______________________________________________ OAuth mailing list -- oauth@ietf.org To unsubscribe send an email to oauth-le...@ietf.org
