Subject: [secdir] SecDir revirw of draft-reschke-webdav-post-06

From: Stefan Santesson <[email-masked]>
Date: Wed, 28 Apr 2010 11:16:16 +0200

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

This document inherits the security considerations of WebDAV as well as XML.
RFC 4918 clearly identifies that WebDAV, through its nature of providing
users with capabilities to change and collect information from web servers,
introduces a number of security issues which need to be addressed through
means of protected and authenticated communication.

Rather than introducing completely new functions to WebDAV, the current
draft specifies the meaning existing functions as well as means of
discovering server support for this draft.

>From this perspective I can¹t see that this draft introduce new risks that
are not already addressed in the security considerations section of this
draft or inherited sections form other documents (such as RFC 4918).

/Stefan Santesson