I'll repeat, the poll was ""Do people agree there is a problem to be solved"
and the votes were a majority *no*. None of these agreements came out of the WG call: Members of the WG agree there is a problem/smoking gun > Members of the WG disagree on the breaking change introduce as the > unitarily option to solve it > Members of the WG agree to more deeply formalize the problem so that > additional options to work on could be formalized post adoption And I'm unclear what "the breaking change" is referring to. The proposed solution (which was not voted on) does not break anything existing. It allows incremental deployment. On Mon, Sep 28, 2026 at 3:10 PM Aaron Parecki <[email protected]> wrote: > I will add my American 2 cents to Jeff's summary. > > > On Mon, Sep 28, 2026 at 7:03 AM Lombardo, Jeff <jeffsec= > [email protected]> wrote: > >> Are you, Emelia and Dick [and all who voted], saying the same thing? >> >> "Do people agree there is a problem to be solved" is not a the same of >> "Do people agree there is a problem to be solved *like that*" as Emelia >> pointed. >> >> >> >> My 2 Canadian cents (roughly 0.1 US cent those days) is that: >> >> - Members of the WG agree there is a problem/smoking gun >> - Members of the WG disagree on the breaking change introduce as the >> unitarily option to solve it >> - Members of the WG agree to more deeply formalize the problem so >> that additional options to work on could be formalized post adoption >> >> >> >> *Jean-François “Jeff” Lombardo* | Amazon Web Services >> >> >> Principal Standards Specialist, Identity Services >> Montréal, Canada >> >> >> >> *From:* Dick Hardt <[email protected]> >> *Sent:* September 28, 2026 8:48 AM >> *To:* [email protected] >> *Cc:* Sam Goto <[email protected]> >> *Subject:* [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a >> problem the WG wants to solve? >> >> >> >> *CAUTION*: This email originated from outside of the organization. Do >> not click links or open attachments unless you can confirm the sender and >> know the content is safe. >> >> >> >> *AVERTISSEMENT*: Ce courrier électronique provient d’un expéditeur >> externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous >> ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas >> certain que le contenu ne présente aucun risque. >> >> >> >> Checking in to see if this problem is something the WG wants to work on. >> >> >> >> On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]> wrote: >> >> Hi Emilia >> >> >> >> The poll text was "Do people agree there is a problem to be solved" >> >> https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ >> >> Slide 4 of the presentation was presented during the poll. >> >> >> The poll was not adoption of the draft by the WG. >> >> /Dick >> >> >> >> On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]> wrote: >> >> Hi Dick, >> >> >> >> My interpretation from yesterday was that we were asked "Do we want to >> adopt this specific solution" and the answer was "no, because it's unclear >> if this actually solves the problem or not based on reading the draft text >> alone" >> >> >> >> There's no clear definition of the problem, therefore there can't be a >> solution, yet. >> >> >> >> — Emelia >> >> >> >> On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]> wrote: >> >> >> >> Hey >> >> >> >> At the September 21 interim [1], the chairs asked if there authorization >> code exfiltration is a problem to be solved. 3 said yes, 5 said no. >> >> >> >> The authorization code is a credential that we deliver in the redirect >> URL. From there it can be exfiltrated through history, logs, Referer, page >> JavaScript and extensions. Based on the Browser-Swapping thread [2] and the >> support for Redirect Headers in December [3], I had thought there was >> consensus that this is a problem. >> >> >> >> Do you think exfiltration of the authorization code is a problem this WG >> should solve? >> >> >> >> /Dick >> >> >> >> [1] >> https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth >> >> [2] >> https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ >> >> [3] >> https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ >> >> _______________________________________________ >> OAuth mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> >> >> >> _______________________________________________ >> OAuth mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
