Subject: [P2PSIP] 10.3 Credentials - URL Paramaters Not Possible

From: jc <[email-masked]>
Date: Fri, 18 Sep 2009 17:17:33 -0700

Hi,

"If authentication is required, there is a URL parameter of "password"  
and..."

It's not possible to send URL parameters with a POST with a content- 
type of application/pkix-cert.

Julian

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 18 Sep 2009 17:31:09 -0700

Hmm... I'm not sure that's actually true.

I just skimmed through the relevant sections of RFC 2616 and I actually
don't see a prohibition on using query parameters with POST. What
section do you believe prohibits this?

-Ekr

On Fri, Sep 18, 2009 at 5:17 PM, jc <[email-masked]> wrote:
> It's not possible to send URL parameters with a POST with a content-type of
> application/pkix-cert.
>
> Julian
> _______________________________________________
> P2PSIP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/p2psip
>

---

From: Theo Zourzouvillys <[email-masked]>
Date: Fri, 18 Sep 2009 17:37:49 -0700

> It's not possible to send URL parameters with a POST with a content-type of

Yes, it is possible - and a totally valid thing to do.

 ~ Theo

---

From: jc <[email-masked]>
Date: Fri, 18 Sep 2009 17:53:00 -0700

If content-type = application/pkix-cert in the request then the server  
application won't be able to pull these out.

Example: $_POST["password"] would be null in php because application/x- 
www-form-urlencoded is NOT the content-type.

Julian

---

From: Theo Zourzouvillys <[email-masked]>
Date: Fri, 18 Sep 2009 17:57:06 -0700

On Fri, Sep 18, 2009 at 5:53 PM, jc <[email-masked]> wrote:
> Example: $_POST["password"] would be null in php because
> application/x-www-form-urlencoded is NOT the content-type.
>

POST to http://moo.com/cows.php?password=udder

if ($_GET['password'] != 'udder')
 ...

 ~ Theo

-- 

Sent from Brisbane, California, United States

---

From: jc <[email-masked]>
Date: Fri, 18 Sep 2009 18:02:27 -0700

That was my point to begin with. You cannot do a POST with URL  
parameters without a GET.

Julian

---

From: jc <[email-masked]>
Date: Fri, 18 Sep 2009 18:13:12 -0700

Thanks for pointing out that it's ok to do this in php. It seemed like  
a hack to me because i've simply never seen it done. Working fine with  
my nodes and credential server, all happy. :-)

Julian

---

From: Theo Zourzouvillys <[email-masked]>
Date: Fri, 18 Sep 2009 18:13:42 -0700

On Fri, Sep 18, 2009 at 6:02 PM, jc <[email-masked]> wrote:
> That was my point to begin with. You cannot do a POST with URL parameters
> without a GET.
>

huu?

# telnet moo.cows 80

-> POST /cows.php?password=udder HTTP/1.0
-> Host: cows.com
-> Content-Type: aplpication/pkix
-> Content-Length: xxx
->...
->
-> [some data]

# cat cows.php
<?php

assert($_SERVER['REQUEST_METHOD'] == 'POST');
assert($_GET['password'] == 'udder');
assert(file_get_contents('php://input') == '[some data]');

 ~ Theo

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 18 Sep 2009 19:24:53 -0700

> application/x-www-form-urlencoded is NOT the content-type.

What does PHP have to do with anything?

The server proper has the URI and the body available to it. If there
is some language that doesn't allow access to that data, that's
a deficiency in the language, not a protocol issue.

-Ekr