Subject: [scim] Non URL based Search

From: Phil Hunt <[email-masked]>
Date: Thu, 1 Nov 2012 14:25:01 -0700

In case its already there, do we have a tracker issue for an alternative form of search so that filter parameters are not included in the URL? 

Specifically I'm worried about confidentiality (in access logs) and injection attacks.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Melinda Shore <[email-masked]>
Date: Thu, 01 Nov 2012 13:38:08 -0800

On 11/1/12 1:25 PM, Phil Hunt wrote:
> In case its already there, do we have a tracker issue for an
> alternative form of search so that filter parameters are not included
> in the URL?

Yes, that's #25, which says "Add ability to retrieve a resource without
including the type in the URL".  At the same time, we've got #17, which
reads "Add the ability to put resource types in URL paths".  The latter
was moved over from the Google issue tracker.  Might be good to work up
some text describing what you need from URL semantics, including
privacy and/or security requirements.

Melinda

---

From: Phil Hunt <[email-masked]>
Date: Thu, 1 Nov 2012 14:44:55 -0700

I think the issue in 25 was to eliminate the resource endpoint from the operation so multiple resource types could be matched against a filter.

This requirement is to eliminate the filter entirely from the URL in the GET operation.  E.g. by creating a /search endpoint that can be accessed using GET or POST (aka X-Search).

I'll add a separate item.  The two may turn out to impact the same parts of the spec. But I think it is a separate issue.

Phil

@independentid
www.independentid.com
[email-masked]

On 2012-11-01, at 2:38 PM, Melinda Shore wrote:

> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim