Are you, Emelia and Dick [and all who voted], saying the same thing? "Do people agree there is a problem to be solved" is not a the same of "Do people agree there is a problem to be solved like that" as Emelia pointed.
My 2 Canadian cents (roughly 0.1 US cent those days) is that: * Members of the WG agree there is a problem/smoking gun * Members of the WG disagree on the breaking change introduce as the unitarily option to solve it * Members of the WG agree to more deeply formalize the problem so that additional options to work on could be formalized post adoption Jean-François “Jeff” Lombardo | Amazon Web Services Principal Standards Specialist, Identity Services Montréal, Canada From: Dick Hardt <[email protected]> Sent: September 28, 2026 8:48 AM To: [email protected] Cc: Sam Goto <[email protected]> Subject: [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a problem the WG wants to solve? CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. AVERTISSEMENT: Ce courrier électronique provient d’un expéditeur externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas certain que le contenu ne présente aucun risque. Checking in to see if this problem is something the WG wants to work on. On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]<mailto:[email protected]>> wrote: Hi Emilia The poll text was "Do people agree there is a problem to be solved" https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ Slide 4 of the presentation was presented during the poll. The poll was not adoption of the draft by the WG. /Dick On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]<mailto:[email protected]>> wrote: Hi Dick, My interpretation from yesterday was that we were asked "Do we want to adopt this specific solution" and the answer was "no, because it's unclear if this actually solves the problem or not based on reading the draft text alone" There's no clear definition of the problem, therefore there can't be a solution, yet. — Emelia On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]<mailto:[email protected]>> wrote: Hey At the September 21 interim [1], the chairs asked if there authorization code exfiltration is a problem to be solved. 3 said yes, 5 said no. The authorization code is a credential that we deliver in the redirect URL. From there it can be exfiltrated through history, logs, Referer, page JavaScript and extensions. Based on the Browser-Swapping thread [2] and the support for Redirect Headers in December [3], I had thought there was consensus that this is a problem. Do you think exfiltration of the authorization code is a problem this WG should solve? /Dick [1] https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth [2] https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ [3] https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ _______________________________________________ OAuth mailing list -- [email protected]<mailto:[email protected]> To unsubscribe send an email to [email protected]<mailto:[email protected]>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
