<div dir="ltr">Hello Mike, everyone,<div class="gmail_extra"><br></div><div class="gmail_extra">I summarized my findings and showcased an example cookie based implementation of affected session management OP frame in Issue #1003 . The example shows how cookie based implementations may mitigate the nasty sideeffect of endless "changed" states returned to the RP.</div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature">Best,<br><b>Filip Skokan</b></div></div>
<br><div class="gmail_quote">On Sun, Feb 5, 2017 at 7:26 PM, Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_6896158215538114478WordSection1">
<p class="MsoNormal"><span style="color:rgb(0,32,96)">Hi Filip,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">The main thing needed is for someone to clearly and concisely write down a description of the limitations and for the working group to review. Then it can be added to the specifications in the future.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">There’s an issue about this at <a href="https://bitbucket.org/openid/connect/issues/1003/document-possible-impacts-of-disabling" target="_blank">
https://bitbucket.org/openid/<wbr>connect/issues/1003/document-<wbr>possible-impacts-of-disabling</a> but it hasn’t been assigned to anyone. If you’d like to take a crack at it, have at it. You could add the proposed text directly to the issue.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">The good news is that adding this text wouldn’t change what the specifications do or how they work, so doing so wouldn’t be a breaking change later. It would simply be commentary on how implementations will
work (or not) in certain environments. Also, note that these are proposed to be Implementer’s Drafts – not Final Specifications. So there will be plenty of time in the future to add this commentary once there is working group consensus on what we actually
want to say.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">Thanks for bringing this issue back up.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> <wbr> Best wishes,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> <wbr> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><a name="m_6896158215538114478__MailEndCompose"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></a></p>
<span></span>
<p class="MsoNormal"><b>From:</b> Filip [mailto:<a href="mailto:panva.ip@gmail.com" target="_blank">panva.ip@gmail.com</a>] <br>
<b>Sent:</b> Sunday, February 5, 2017 12:52 AM<br>
<b>To:</b> Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>>; <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.<wbr>net</a><br>
<b>Subject:</b> Re: [Openid-specs-ab] Review of Proposed Implementer’s Drafts of OpenID Connect Logout Specifications<u></u><u></u></p><div><div class="gmail-h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">When would the notes about limitations coming from third party cookie disabled browsers make it's way to the specifications? (session and frontchannel).<u></u><u></u></p>
<div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Best,<br>
<b>Filip Skokan</b><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Sun, Feb 5, 2017 at 12:48 AM, Mike Jones via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.<wbr>net</a>> wrote:<u></u><u></u></p>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p style="line-height:15pt"><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)">The OpenID Connect Working Group recommends approval of the following specifications as OpenID Implementer’s Drafts:</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:18.75pt;line-height:15pt">
<span style="font-size:10pt;font-family:symbol;color:rgb(90,90,90)">·</span><span style="font-size:7pt;font-family:"times new roman",serif;color:rgb(90,90,90)">
</span><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)"><a href="http://openid.net/specs/openid-connect-session-1_0-28.html" target="_blank">Session Management</a> – Defines how to manage OpenID Connect sessions, including postMessage-based
logout functionality</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:18.75pt;line-height:15pt">
<span style="font-size:10pt;font-family:symbol;color:rgb(90,90,90)">·</span><span style="font-size:7pt;font-family:"times new roman",serif;color:rgb(90,90,90)">
</span><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)"><a href="http://openid.net/specs/openid-connect-frontchannel-1_0-02.html" target="_blank">Front-Channel Logout</a> – Defines a front-channel logout mechanism that does not
use an OP iframe on RP pages</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:18.75pt;line-height:15pt">
<span style="font-size:10pt;font-family:symbol;color:rgb(90,90,90)">·</span><span style="font-size:7pt;font-family:"times new roman",serif;color:rgb(90,90,90)">
</span><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)"><a href="http://openid.net/specs/openid-connect-backchannel-1_0-04.html" target="_blank">Back-Channel Logout</a> – Defines a logout mechanism that uses back-channel communication
between the OP and RPs being logged out</span><u></u><u></u></p>
<p style="line-height:15pt"><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)">Each of these protocols communicate logout requests from OpenID Providers to Relying Parties, but using different mechanisms that are appropriate for
different use cases. See the Introduction section of each of the specifications for descriptions of the mechanisms used and comparisons between them. All the specifications share a common mechanism for communicating logout requests from Relying Parties to
OpenID Providers.</span><u></u><u></u></p>
<p style="line-height:15pt"><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)">An Implementer’s Draft is a stable version of a specification providing intellectual property protections to implementers of the specification. This
note starts the 45-day public review period for the specification drafts in accordance with the OpenID Foundation IPR policies and procedures. This review period will end on Tuesday, March 21, 2017. Unless issues are identified during the review that the working
group believes must be addressed by revising the drafts, this review period will be followed by a seven-day voting period during which OpenID Foundation members will vote on whether to approve these drafts as OpenID Implementer’s Drafts. For the convenience
of members, voting may begin up to two weeks before March 21st, with the voting period still ending on Tuesday, March 28, 2017.</span><u></u><u></u></p>
<p style="line-height:15pt"><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)">These specifications are available at:</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:18.75pt;line-height:15pt">
<span style="font-size:10pt;font-family:symbol;color:rgb(90,90,90)">·</span><span style="font-size:7pt;font-family:"times new roman",serif;color:rgb(90,90,90)">
</span><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)"><a href="http://openid.net/specs/openid-connect-session-1_0-28.html" target="_blank">http://openid.net/specs/<wbr>openid-connect-session-1_0-28.<wbr>html</a></span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:18.75pt;line-height:15pt">
<span style="font-size:10pt;font-family:symbol;color:rgb(90,90,90)">·</span><span style="font-size:7pt;font-family:"times new roman",serif;color:rgb(90,90,90)">
</span><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)"><a href="http://openid.net/specs/openid-connect-frontchannel-1_0-02.html" target="_blank">http://openid.net/specs/<wbr>openid-connect-frontchannel-1_<wbr>0-02.html</a></span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:18.75pt;line-height:15pt">
<span style="font-size:10pt;font-family:symbol;color:rgb(90,90,90)">·</span><span style="font-size:7pt;font-family:"times new roman",serif;color:rgb(90,90,90)">
</span><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)"><a href="http://openid.net/specs/openid-connect-backchannel-1_0-04.html" target="_blank">http://openid.net/specs/<wbr>openid-connect-backchannel-1_<wbr>0-04.html</a></span><u></u><u></u></p>
<p style="line-height:15pt"><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)">A description of OpenID Connect can be found at
<a href="http://openid.net/connect/" target="_blank">http://openid.net/connect/</a>. The working group page is
<a href="http://openid.net/wg/connect/" target="_blank">http://openid.net/wg/connect/</a>. Information on joining the OpenID Foundation can be found at
<a href="https://openid.net/foundation/members/registration" target="_blank">https://openid.net/foundation/<wbr>members/registration</a>. If you’re not a current OpenID Foundation member, please consider joining to participate in the approval vote.</span><u></u><u></u></p>
<p style="line-height:15pt"><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)">You can send feedback on the specifications in a way that enables the working group to act upon your feedback by (1) signing the contribution agreement
at <a href="http://openid.net/intellectual-property/" target="_blank">http://openid.net/<wbr>intellectual-property/</a> to join the working group (please specify that you are joining the “AB+Connect” working group on your contribution agreement), (2) joining the
working group mailing list at <a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">
http://lists.openid.net/<wbr>mailman/listinfo/openid-specs-<wbr>ab</a>, and (3) sending your feedback to the list.</span><u></u><u></u></p>
<p style="line-height:15pt"><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)">— Michael B. Jones – OpenID Foundation Board Secretary</span><u></u><u></u></p>
<p style="line-height:15pt"><span style="font-size:10.5pt;font-family:helvetica,sans-serif;color:rgb(90,90,90)">P.S. This notice was also posted at
<a href="http://openid.net/2017/02/04/review-of-proposed-implementers-drafts-of-openid-connect-logout-specifications/" target="_blank">
http://openid.net/2017/02/04/<wbr>review-of-proposed-<wbr>implementers-drafts-of-openid-<wbr>connect-logout-specifications/</a> and as
<a href="https://twitter.com/openid" target="_blank">@openid</a>.</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12pt"><br>
______________________________<wbr>_________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.<wbr>net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/<wbr>mailman/listinfo/openid-specs-<wbr>ab</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br></div></div>