<div dir="ltr">I read thru the oidc errata - mostly good.<div>One concern is section 16;23 which describes the iOS ability to assign handlers. The paragraph is correct, but there are severe security considerations to this solution that are not included in the document anywhere. Specifically it is too easy to get the user to reassign the pointer to malware. It is easy to get users to do this in my experience, so security considerations are warranted. I did not yet file an issue to see if anyone agreed with me, and then I would do it.</div><div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><span style="background-color:rgb(242,242,242);color:rgba(0,0,0,0.9);font-family:-apple-system,system-ui,system-ui,"Segoe UI",Roboto,"Helvetica Neue","Fira Sans",Ubuntu,Oxygen,"Oxygen Sans",Cantarell,"Droid Sans","Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Lucida Grande",Helvetica,Arial,sans-serif;font-size:14px;white-space:pre-wrap">Let's not lead the user into danger. </span>..tom</div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Aug 14, 2023 at 10:39 AM Andrii Deinega via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><a href="https://mailarchive.ietf.org/arch/msg/oauth/9DdkE2P0RrUZMeZAbdf3NrMfy0w/" target="_blank">https://mailarchive.ietf.org/arch/msg/oauth/9DdkE2P0RrUZMeZAbdf3NrMfy0w/</a> is a link to a discussion on the "pragma" response header in OAuth 2 WG.<br><div><br></div><div>Regards,</div><div>Andrii</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Aug 14, 2023 at 10:23 AM Andrii Deinega <<a href="mailto:andrii.deinega@gmail.com" target="_blank">andrii.deinega@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Michael,<div><br></div><div>Two very minor things.</div><div><br></div><div>1. The pragma HTTP response header can be removed from all examples from all specs. Take a look at an old discussion in the OAuth 2 WG. OAuth 2.1 spec does not have any references to it either.<br><br></div><div>2. The no-store is the strongest cache directive and it already includes no-cache. Hence, the use of "Cache-Control: no-store" in all examples should be enough.<br></div><div><br></div><div>Regards,</div><div>Andrii</div></div><div><br></div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Aug 13, 2023 at 3:23 PM Michael Jones via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div>
<p class="MsoNormal">I’ve published drafts incorporating all the proposed errata corrections for the OpenID Connect family of specifications. This is a major step along the way both towards publishing our second errata set for OpenID Connect and for submission
to ISO as Publicly Available Specification (PAS) standards.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The drafts incorporating the errata corrections are:<u></u><u></u></p>
<ul style="margin-top:0in" type="disc">
<li style="margin-left:0in"><a href="https://openid.net/specs/openid-connect-core-1_0-32.html" target="_blank">https://openid.net/specs/openid-connect-core-1_0-32.html</a><u></u><u></u></li><li style="margin-left:0in"><a href="https://openid.net/specs/openid-connect-discovery-1_0-35.html" target="_blank">https://openid.net/specs/openid-connect-discovery-1_0-35.html</a><u></u><u></u></li><li style="margin-left:0in"><a href="https://openid.net/specs/openid-connect-registration-1_0-37.html" target="_blank">https://openid.net/specs/openid-connect-registration-1_0-37.html</a><u></u><u></u></li><li style="margin-left:0in"><a href="https://openid.net/specs/openid-connect-backchannel-1_0-11.html" target="_blank">https://openid.net/specs/openid-connect-backchannel-1_0-11.html</a><u></u><u></u></li></ul>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The History sections of the specs describe each of the changes made. If you want to see the precise changes incorporated, I suggest using your favorite HTML-capable diff tool (such as Microsoft Word) and comparing the baseline docs below
to the ones above:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ul style="margin-top:0in" type="disc">
<li style="margin-left:0in"><a href="https://openid.net/specs/openid-connect-core-1_0-errata1.html" target="_blank">https://openid.net/specs/openid-connect-core-1_0-errata1.html</a><u></u><u></u></li><li style="margin-left:0in"><a href="https://openid.net/specs/openid-connect-discovery-1_0-errata1.html" target="_blank">https://openid.net/specs/openid-connect-discovery-1_0-errata1.html</a><u></u><u></u></li><li style="margin-left:0in"><a href="https://openid.net/specs/openid-connect-registration-1_0-errata1.html" target="_blank">https://openid.net/specs/openid-connect-registration-1_0-errata1.html</a><u></u><u></u></li><li style="margin-left:0in"><a href="https://openid.net/specs/openid-connect-backchannel-1_0-final.html" target="_blank">https://openid.net/specs/openid-connect-backchannel-1_0-final.html</a><u></u><u></u></li></ul>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Diffs are also possible for the .txt and .xml versions of the specs; just substitute “html” in the URLs above for “txt” or “xml” and use your favorite diff tool.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I plan to ask for working group review of these changes during tomorrow’s working group call. Following the working group review, we’ll hold the foundation-wide 45-day proposed errata review and then the approval vote.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> -- Mike<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">P.S. Our two Implementer’s Guides were also updated in parallel to keep them current with the versions incorporating errata corrections. The corresponding versions are:<u></u><u></u></p>
<ul style="margin-top:0in" type="disc">
<li style="margin-left:0in"><a href="https://openid.net/specs/openid-connect-basic-1_0-44.html" target="_blank">https://openid.net/specs/openid-connect-basic-1_0-44.html</a><u></u><u></u></li><li style="margin-left:0in"><a href="https://openid.net/specs/openid-connect-implicit-1_0-27.html" target="_blank">https://openid.net/specs/openid-connect-implicit-1_0-27.html</a><u></u><u></u></li></ul>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div></div>
</blockquote></div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>