My understanding of the conversation on the call was that the WG does agree there is a problem, but the draft presented did not articulate the problem well enough. The wording of the poll did not capture the conversation very well.
On Mon, Sep 28, 2026 at 8:59 AM Dick Hardt <[email protected]> wrote: > I'll repeat, the poll was ""Do people agree there is a problem to be > solved" > > and the votes were a majority *no*. > > None of these agreements came out of the WG call: > > Members of the WG agree there is a problem/smoking gun >> Members of the WG disagree on the breaking change introduce as the >> unitarily option to solve it >> Members of the WG agree to more deeply formalize the problem so that >> additional options to work on could be formalized post adoption > > > And I'm unclear what "the breaking change" is referring to. > > The proposed solution (which was not voted on) does not break anything > existing. It allows incremental deployment. > > > On Mon, Sep 28, 2026 at 3:10 PM Aaron Parecki <[email protected]> wrote: > >> I will add my American 2 cents to Jeff's summary. >> >> >> On Mon, Sep 28, 2026 at 7:03 AM Lombardo, Jeff <jeffsec= >> [email protected]> wrote: >> >>> Are you, Emelia and Dick [and all who voted], saying the same thing? >>> >>> "Do people agree there is a problem to be solved" is not a the same of >>> "Do people agree there is a problem to be solved *like that*" as Emelia >>> pointed. >>> >>> >>> >>> My 2 Canadian cents (roughly 0.1 US cent those days) is that: >>> >>> - Members of the WG agree there is a problem/smoking gun >>> - Members of the WG disagree on the breaking change introduce as the >>> unitarily option to solve it >>> - Members of the WG agree to more deeply formalize the problem so >>> that additional options to work on could be formalized post adoption >>> >>> >>> >>> *Jean-François “Jeff” Lombardo* | Amazon Web Services >>> >>> >>> Principal Standards Specialist, Identity Services >>> Montréal, Canada >>> >>> >>> >>> *From:* Dick Hardt <[email protected]> >>> *Sent:* September 28, 2026 8:48 AM >>> *To:* [email protected] >>> *Cc:* Sam Goto <[email protected]> >>> *Subject:* [EXT] [OAUTH-WG] Re: Is authorization code exfiltration a >>> problem the WG wants to solve? >>> >>> >>> >>> *CAUTION*: This email originated from outside of the organization. Do >>> not click links or open attachments unless you can confirm the sender and >>> know the content is safe. >>> >>> >>> >>> *AVERTISSEMENT*: Ce courrier électronique provient d’un expéditeur >>> externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous >>> ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas >>> certain que le contenu ne présente aucun risque. >>> >>> >>> >>> Checking in to see if this problem is something the WG wants to work on. >>> >>> >>> >>> On Tue, Sep 22, 2026 at 5:19 PM Dick Hardt <[email protected]> wrote: >>> >>> Hi Emilia >>> >>> >>> >>> The poll text was "Do people agree there is a problem to be solved" >>> >>> >>> https://datatracker.ietf.org/doc/polls-interim-2026-oauth-05-202609211300/ >>> >>> Slide 4 of the presentation was presented during the poll. >>> >>> >>> The poll was not adoption of the draft by the WG. >>> >>> /Dick >>> >>> >>> >>> On Tue, Sep 22, 2026 at 5:02 PM Emelia S. <[email protected]> >>> wrote: >>> >>> Hi Dick, >>> >>> >>> >>> My interpretation from yesterday was that we were asked "Do we want to >>> adopt this specific solution" and the answer was "no, because it's unclear >>> if this actually solves the problem or not based on reading the draft text >>> alone" >>> >>> >>> >>> There's no clear definition of the problem, therefore there can't be a >>> solution, yet. >>> >>> >>> >>> — Emelia >>> >>> >>> >>> On 22 Sep 2026, at 17:05, Dick Hardt <[email protected]> wrote: >>> >>> >>> >>> Hey >>> >>> >>> >>> At the September 21 interim [1], the chairs asked if there authorization >>> code exfiltration is a problem to be solved. 3 said yes, 5 said no. >>> >>> >>> >>> The authorization code is a credential that we deliver in the redirect >>> URL. From there it can be exfiltrated through history, logs, Referer, page >>> JavaScript and extensions. Based on the Browser-Swapping thread [2] and the >>> support for Redirect Headers in December [3], I had thought there was >>> consensus that this is a problem. >>> >>> >>> >>> Do you think exfiltration of the authorization code is a problem this WG >>> should solve? >>> >>> >>> >>> /Dick >>> >>> >>> >>> [1] >>> https://datatracker.ietf.org/meeting/interim-2026-oauth-05/session/oauth >>> >>> [2] >>> https://mailarchive.ietf.org/arch/msg/oauth/K8Wnw08GzPstyAQAh0JmSB47pOQ/ >>> >>> [3] >>> https://mailarchive.ietf.org/arch/msg/oauth/FFkUlOiz7I4K03pqjMfIFkxAwA8/ >>> >>> _______________________________________________ >>> OAuth mailing list -- [email protected] >>> To unsubscribe send an email to [email protected] >>> >>> >>> >>> _______________________________________________ >>> OAuth mailing list -- [email protected] >>> To unsubscribe send an email to [email protected] >>> >>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
