I will add my American 2 cents to Jeff's summary.
On Mon, Sep 28, 2026 at 7:03 AM Lombardo, Jeff <jeffsec= [email protected]> wrote: > Are you, Emelia and Dick [and all who voted], saying the same thing? > > "Do people agree there is a problem to be solved" is not a the same of "Do > people agree there is a problem to be solved *like that*" as Emelia > pointed. > > > > My 2 Canadian cents (roughly 0.1 US cent those days) is that: > > - Members of the WG agree there is a problem/smoking gun > - Members of the WG disagree on the breaking change introduce as the > unitarily option to solve it > - Members of the WG agree to more deeply formalize the problem so that > additional options to work on could be formalized post adoption > > > > *Jean-François “Jeff” Lombardo* | Amazon Web Services > > > Principal Standards Specialist, Identity Services > Montréal, Canada > > > > *From:* Dick Hardt <[email protected]> > *Sent:* September 28, 2026 8:48 AM > *To:* [email protected] > *Cc:* Sam Goto <[email protected]> > *Subject:* [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a > problem the WG wants to solve? > > > > *CAUTION*: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and know > the content is safe. > > > > *AVERTISSEMENT*: Ce courrier électronique provient d’un expéditeur > externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous > ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas > certain que le contenu ne présente aucun risque. > > > > Checking in to see if this problem is something the WG wants to work on. > > > > On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]> wrote: > > Hi Emilia > > > > The poll text was "Do people agree there is a problem to be solved" > > https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ > > Slide 4 of the presentation was presented during the poll. > > > The poll was not adoption of the draft by the WG. > > /Dick > > > > On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]> wrote: > > Hi Dick, > > > > My interpretation from yesterday was that we were asked "Do we want to > adopt this specific solution" and the answer was "no, because it's unclear > if this actually solves the problem or not based on reading the draft text > alone" > > > > There's no clear definition of the problem, therefore there can't be a > solution, yet. > > > > — Emelia > > > > On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]> wrote: > > > > Hey > > > > At the September 21 interim [1], the chairs asked if there authorization > code exfiltration is a problem to be solved. 3 said yes, 5 said no. > > > > The authorization code is a credential that we deliver in the redirect > URL. From there it can be exfiltrated through history, logs, Referer, page > JavaScript and extensions. Based on the Browser-Swapping thread [2] and the > support for Redirect Headers in December [3], I had thought there was > consensus that this is a problem. > > > > Do you think exfiltration of the authorization code is a problem this WG > should solve? > > > > /Dick > > > > [1] > https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth > > [2] > https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ > > [3] > https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ > > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] > > > > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
