Subject: [weirds] Alissa Cooper's Discuss on draft-ietf-weirds-using-http-14: (with DISCUSS)

From: "Alissa Cooper" <[email-masked]>
Date: Tue, 28 Oct 2014 16:17:00 -0700

Alissa Cooper has entered the following ballot position for
draft-ietf-weirds-using-http-14: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-weirds-using-http/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

= Section 5.6 =
"When responding to queries, it is RECOMMENDED that servers use the
   Access-Control-Allow-Origin header field, as specified by
   [W3C.CR-cors-20130129].  As the use of RDAP is for public resources,
   a value of "*" is suitable for most cases."

What is the use case for cross-site RDAP queries?

Also, I am confused by the claim in the second sentence. The message that
I got from draft-ietf-weirds-rdap-sec and draft-ietf-weirds-json-response
is that one of the motivations for using HTTP for RDAP was that its
authentication features could be leveraged to provide tiered access to
data on the server, such that some of the data would not be public but
would be restricted to specific users (from
draft-ietf-weirds-json-response, Appendix A.1: "In many use cases, it is
necessary to hide or obscure the information of a registrant or contact
due to policy or other operational matters."). So it seems like if
cross-site requests are justified at all, there should be some text here
explaining when that might be the case and when not.

---

From: Richard Barnes <[email-masked]>
Date: Wed, 29 Oct 2014 23:52:42 -0700

> http://datatracker.ietf.org/doc/draft-ietf-weirds-using-http/

This seems pretty obvious to me; see, e.g., https://who.is/

> explaining when that might be the case and when not.

I agree that some clarification could be useful, in light of the fact that
not *all* RDAP data will be public.

In particular, I note that cross-origin requests (if authorized) will be
sent with the user's cookies.  So RDAP server operators should keep in mind
that if they allow cross-origin requests, then they might expose
access-controlled information to origins that might not be authorized.  The
right mitigation is probably to suggest checking the Origin header and
using that as a secondary control.

--Richard