Document: draft-ietf-regext-epp-https Title: Extensible Provisioning Protocol (EPP) Transport over HTTPS Reviewer: Mark Nottingham Review result: Ready with Nits
# Comments ## Consider specifying redirect handling for EPP requests Section 4 says clients “MUST process any HTTP response according to its status-code semantics,” but does not say whether to follow redirects or under what conditions. RFC 9110 permits automatic redirects; depending on the status code, a client may change POST to GET or resend the POST to the redirect target. That can break EPP processing or expose command content and session credentials. RFC 9205 specifically recommends that applications define redirect handling. ## Consider requiring verification of the HTTPS server identity Section 9 requires HTTPS to protect credentials and the session identifier, but does not explicitly require clients to verify that the certificate matches the server URL. RFC 9110 already defines that requirement, but RFC 9205 recommends that an application using HTTPS state it explicitly. Naming RFC 9110 4.3.4 would make clear that encryption without server authentication is insufficient. # Nits * The greeting response example in section 4.1 omits X-Content-Type-Options: nosniff, which section 3 requires. _______________________________________________ regext mailing list -- [email protected] To unsubscribe send an email to [email protected]
