Subject: [Webpush] Alexey Melnikov's No Objection on draft-ietf-webpush-vapid-03: (with COMMENT)

From: Alexey Melnikov <[email-masked]>
Date: Tue, 15 Aug 2017 10:12:34 -0700

Alexey Melnikov has entered the following ballot position for
draft-ietf-webpush-vapid-03: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-webpush-vapid/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I have cleared my DISCUSS based on changes in git.

I am looking forward to continuing discussion about advertising support for the
"vapid" authentication scheme in WWW-Authenticate:

In Section 3, 3rd para:

   This authentication scheme does not require a challenge.  Clients are
   able to generate the Authorization header field without any
   additional information from a server.  Therefore, a challenge for
   this authentication scheme MUST NOT be sent in a WWW-Authenticate
   header field.

Does this mean that there is no way to discover whether a particular server
supports "vapid" HTTP authentication scheme?

---

From: Costin Manolache <[email-masked]>
Date: Tue, 15 Aug 2017 10:56:50 -0700

IMHO out-of-band discovery may be sufficient - in webpush it is implicit or
can be part of the
subscribe handshake. If VAPID is used with an API the supported auth may be
part of the API
schema/discovery.

I think in future it may be valuable to add an optional certificate -
either as an extra header or parameter -
to allow authentication without a database RT. In such mode a mechanism to
discover supported
roots may be needed - however it can also be done out-of-band.

B

Costin

On Tue, Aug 15, 2017 at 10:12 AM, Alexey Melnikov <[email-masked]>
wrote:

> _______________________________________________
> Webpush mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webpush
>

---

From: Martin Thomson <[email-masked]>
Date: Wed, 16 Aug 2017 11:24:15 +1000

We have previously discussed the problem of discovering whether a
server supports a particular authentication scheme.  On the API side,
we didn't resolve to make a change that would add a mechanism similar
to what we use for content coding (see
https://github.com/w3c/push-api/pull/262 for that discussion).  This
is approximately what Costin is talking about here.

What has changed since that time is that I have learned that some push
services *require* authentication.

For that reason, though it adds delays to sending when authentication
fails, I'm inclined to add a challenge.  It would be empty, but it
would allow a server to insist on authentication in a transparent way.

It IS easy to define: https://github.com/webpush-wg/webpush-vapid/pull/42

On 16 August 2017 at 03:56, Costin Manolache <[email-masked]> wrote:
> I think in future it may be valuable to add an optional certificate - either
> as an extra header or parameter -

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 16 Aug 2017 09:44:11 +0100

Hi Martin,

> On 16 Aug 2017, at 02:24, Martin Thomson <[email-masked]> wrote:
> 

Just returning auth-scheme with no parameter is exactly what I was talking about. I like this change.