Subject: [Unbearable] Suggested change in wording for signal to send referred binding

From: "Cantor, Scott" <[email-masked]>
Date: Mon, 4 Apr 2016 13:12:41 +0000

This isn't terribly substantive, but it jumped out at me while I was reading these drafts for the first time. The tokbind-https draft mentions the token consumer giving the client "permission" to send a referred token binding to the token provider.

That struck me as strange wording, as though the RP is in a permission to dictate this or that it "owns" the binding. My sense was that revealing a token binding is more of a privacy consideration and that the bindings are really more thought of as being owned by the client.

I got the impression that the purpose of the header in that draft was more about signaling to the client that the destination of the redirect wants/needs the binding, and that the client should (if it deems it appropriate) send it.

The tone of the draft seemed to give the agency to the RP, and it seemed to me the client should have the agency, not be asking permission of the RP.

Is that fair?

-- Scott

---

From: Andrei Popov <[email-masked]>
Date: Mon, 4 Apr 2016 17:47:20 +0000

Hi Scott,

I agree that "permission" is probably not the best word. This header is indeed a signal from the RP to the user agent.

Cheers,

Andrei

-----Original Message-----
From: Unbearable [mailto:[email-masked]] On Behalf Of Cantor, Scott
Sent: Monday, April 4, 2016 10:13 AM
To: [email-masked]
Subject: [Unbearable] Suggested change in wording for signal to send referred binding

Is that fair?

-- Scott

_______________________________________________
Unbearable mailing list
[email-masked]
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2funbearable&data=01%7c01%7cAndrei.Popov%40microsoft.com%7c32ea48e2b362493b7f7108d35c8ad361%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=MTabeU7kgEQ%2fLn4ZIsGVMoBFVHwmRRZ4i1sOy%2fEYQ4k%3d