Subject: [webfinger] WebFinger redirection: client SHOULD or MUST?

From: "Paul E. Jones" <[email-masked]>
Date: Wed, 19 Dec 2012 21:39:04 -0500

Folks,

We're looking at text like this related to redirection:

WebFinger servers MAY redirect a client using a redirection HTTP status code
to another HTTPS URI, but MUST NOT redirect a client to an HTTP URI.
Further, clients MUST NOT follow a redirection to an HTTP URI, but SHOULD
follow all server redirects to HTTPS URIs.

Note the word "SHOULD" on the client's requirement to follow redirects.
This softer requirement has been floated around on the list now for a week
or longer (e.g., see Sal's note on 12 Dec 2012), but the -07 version of the
document mandates that clients follow redirects.  I cannot recall why this
change was made, but it might have been out of security concerns.

Now that we are using HTTPS only, should we change that SHOULD back to a
MUST as was in the -07 draft?

Paul

---

From: Brad Fitzpatrick <[email-masked]>
Date: Wed, 19 Dec 2012 18:41:15 -0800

I wouldn't worry about it.  SHOULD is fine.

Some small number of people will violate it anyway for security or paranoia
reasons (and they probably know what they're doing), and most people will
be using some higher-level HTTP client that doesn't give them options
anyway and will probably just do the right thing.

So changing the wording only affects a small number of people who won't
care to necessarily follow it anyway.

On Wed, Dec 19, 2012 at 6:39 PM, Paul E. Jones <[email-masked]>wrote:

> Folks,****
>
> ** **
>
> We’re looking at text like this related to redirection:****
>
> ** **
>
> WebFinger servers MAY redirect a client using a redirection HTTP status
> code to another HTTPS URI, but MUST NOT redirect a client to an HTTP URI.
> Further, clients MUST NOT follow a redirection to an HTTP URI, but SHOULDfollow all server redirects to HTTPS URIs.
> ****
>
> ** **
>
> Note the word “SHOULD” on the client’s requirement to follow redirects.
> or longer (e.g., see Sal’s note on 12 Dec 2012), but the -07 version of the
> change was made, but it might have been out of security concerns.****
>
> ** **
>
> MUST as was in the -07 draft?****
>
> ** **
>
> Paul****
>
> ** **
>

---

From: Brad Fitzpatrick <[email-masked]>
Date: Wed, 19 Dec 2012 18:44:12 -0800

For instance, if I look up [email-masked]'s WebFinger like:

   GET /.well-known/webfinger?resource=acct:[email-masked]/1.1
   Host: evil.example.net

And they reply:

  HTTP/1.1 302 Found
  Location:
http://10.0.0.17/some/internal/service/delete_account?user=victim

Is it a MUST that I follow that redirect?  Hell no.

This is why I wrote
http://search.cpan.org/~bradfitz/LWPx-ParanoidAgent/lib/LWPx/ParanoidAgent.pmback
in the day, but variants with similar policies exist for nearly all
languages / organizations.

On Wed, Dec 19, 2012 at 6:41 PM, Brad Fitzpatrick <[email-masked]>wrote:

> Some small number of people will violate it anyway for security or
> paranoia reasons (and they probably know what they're doing), and most
> people will be using some higher-level HTTP client that doesn't give them
> options anyway and will probably just do the right thing.
>

---

From: Tim Bray <[email-masked]>
Date: Wed, 19 Dec 2012 18:48:04 -0800

I'd just say "retrieval must be via HTTPS" and defer all this http stuff to
the http spec. I just don't see how we add value by discussing details of
how to redirect; the state of that art is well understood
On Dec 19, 2012 6:44 PM, "Brad Fitzpatrick" <[email-masked]> wrote:

> http://search.cpan.org/~bradfitz/LWPx-ParanoidAgent/lib/LWPx/ParanoidAgent.pmback in the day, but variants with similar policies exist for nearly all
>>> Further, clients MUST NOT follow a redirection to an HTTP URI, but
>>> SHOULD follow all server redirects to HTTPS URIs.****
>>>
>>> ** **
>>>
> _______________________________________________
> webfinger mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webfinger
>
>

---

From: [email-masked]
Date: Thu, 20 Dec 2012 11:48:43 +0000 (GMT)

> how to redirect; the state of that art is well understood

+1

-- 
Chris Dent                                   http://burningchrome.com/
                                 [...]

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 20 Dec 2012 10:51:35 -0500

The reason the text is there relates to security.   Specifically, we do not
want it to be legal for a WF server to redirect a client that queried via
HTTPS to be directed to a non-secure URI.

Paul

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Tim Bray
Sent: Wednesday, December 19, 2012 9:48 PM
To: Brad Fitzpatrick
Cc: [email-masked]; [email-masked]
Subject: Re: [webfinger] WebFinger redirection: client SHOULD or MUST?

   GET /.well-known/webfinger?resource=acct:[email-masked]
<mailto:[email-masked]>  HTTP/1.1

   Host: evil.example.net

And they reply:

  HTTP/1.1 302 Found

  Location:

This is why I wrote
http://search.cpan.org/~bradfitz/LWPx-ParanoidAgent/lib/LWPx/ParanoidAgent.p
m back in the day, but variants with similar policies exist for nearly all
languages / organizations.

On Wed, Dec 19, 2012 at 6:41 PM, Brad Fitzpatrick <[email-masked]>
wrote:

Some small number of people will violate it anyway for security or paranoia
reasons (and they probably know what they're doing), and most people will be
using some higher-level HTTP client that doesn't give them options anyway
and will probably just do the right thing.

So changing the wording only affects a small number of people who won't care
to necessarily follow it anyway.

On Wed, Dec 19, 2012 at 6:39 PM, Paul E. Jones <[email-masked]>
wrote:

Folks,

Paul

---

From: Tim Bray <[email-masked]>
Date: Thu, 20 Dec 2012 07:53:23 -0800

Right, so if there’s a one-liner at the beginning of the protocol section
saying “All requests (including redirects) MUST be directed to “https:”
URIs” you’ve got it covered.

On Thu, Dec 20, 2012 at 7:51 AM, Paul E. Jones <[email-masked]>wrote:

> The reason the text is there relates to security.   Specifically, we do
> not want it to be legal for a WF server to redirect a client that queried
> via HTTPS to be directed to a non-secure URI.****
>
> ** **
>
> Paul****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On
> Behalf Of *Tim Bray
> *Sent:* Wednesday, December 19, 2012 9:48 PM
> *To:* Brad Fitzpatrick
> *Cc:* [email-masked]; [email-masked]
> *Subject:* Re: [webfinger] WebFinger redirection: client SHOULD or MUST?**
> **
>
> ** **
>
> I'd just say "retrieval must be via HTTPS" and defer all this http stuff
> to the http spec. I just don't see how we add value by discussing details
> of how to redirect; the state of that art is well understood****
>
> On Dec 19, 2012 6:44 PM, "Brad Fitzpatrick" <[email-masked]> wrote:**
> **
>
> For instance, if I look up [email-masked]'s WebFinger like:****
>
> ** **
>
>    Host: evil.example.net****
>
> ** **
>
> And they reply:****
>
> ** **
>
>   HTTP/1.1 302 Found****
>
>   Location:
> http://10.0.0.17/some/internal/service/delete_account?user=victim****
>
> ** **
>
> Is it a MUST that I follow that redirect?  Hell no.****
>
> ** **
>
> This is why I wrote
> languages / organizations.****
>
> ** **
>
> ** **
>
> ** **
>
> wrote:****
> I wouldn't worry about it.  SHOULD is fine.****
>
> ** **
>
> options anyway and will probably just do the right thing.****
>
> ** **
>
> care to necessarily follow it anyway.****
>
> ** **
>
> ** **
>
> wrote:****
> https://www.ietf.org/mailman/listinfo/webfinger****
>

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 20 Dec 2012 10:58:31 -0500

At present, it's just a two-liner.  We could reduce it down to this:

"A WebFinger server MAY redirect the client, but MUST only redirect the
client to an HTTPS URI."

Paul

From: Tim Bray [mailto:[email-masked]] 
Sent: Thursday, December 20, 2012 10:53 AM
To: Paul E. Jones
Cc: Brad Fitzpatrick; [email-masked]; [email-masked]
Subject: Re: [webfinger] WebFinger redirection: client SHOULD or MUST?

Right, so if there's a one-liner at the beginning of the protocol section
saying "All requests (including redirects) MUST be directed to "https:"
URIs" you've got it covered.

On Thu, Dec 20, 2012 at 7:51 AM, Paul E. Jones <[email-masked]>
wrote:

Paul

   Host: evil.example.net

And they reply:

  HTTP/1.1 302 Found

  Location:

This is why I wrote

 

Folks,

Paul

---

From: Tim Bray <[email-masked]>
Date: Thu, 20 Dec 2012 07:59:58 -0800

+1

On Thu, Dec 20, 2012 at 7:58 AM, Paul E. Jones <[email-masked]>wrote:

> At present, it’s just a two-liner.  We could reduce it down to this:****
>
> ** **
>
> “A WebFinger server MAY redirect the client, but MUST only redirect the
> client to an HTTPS URI.”****
>
> ** **
>
> Paul****
>
> ** **
>
> *From:* Tim Bray [mailto:[email-masked]]
> *Sent:* Thursday, December 20, 2012 10:53 AM
> *To:* Paul E. Jones
> *Cc:* Brad Fitzpatrick; [email-masked]; [email-masked]
>
> URIs” you’ve got it covered.****
>