draft-ietf-httpbis-client-cert-field-00.txt   draft-ietf-httpbis-client-cert-field-latest.txt 
HTTP Working Group B. Campbell HTTP Working Group B. Campbell
Internet-Draft Ping Identity Internet-Draft Ping Identity
Intended status: Informational M. Bishop, Ed. Intended status: Informational M. Bishop, Ed.
Expires: December 10, 2021 Akamai Expires: March 17, 2022 Akamai
June 8, 2021 September 13, 2021
Client-Cert HTTP Header Field: Conveying Client Certificate Information Client-Cert HTTP Header Field: Conveying Client Certificate Information
from TLS Terminating Reverse Proxies to Origin Server Applications from TLS Terminating Reverse Proxies to Origin Server Applications
draft-ietf-httpbis-client-cert-field-00 draft-ietf-httpbis-client-cert-field-latest
Abstract Abstract
This document defines the HTTP header field "Client-Cert" that allows This document defines the HTTP header field "Client-Cert" that allows
a TLS terminating reverse proxy to convey the client certificate of a a TLS terminating reverse proxy to convey the client certificate of a
mutually-authenticated TLS connection to the origin server in a mutually-authenticated TLS connection to the origin server in a
common and predictable manner. common and predictable manner.
Note to Readers Note to Readers
_RFC EDITOR: please remove this section before publication_ _RFC EDITOR: please remove this section before publication_
Discussion of this draft takes place on the HTTP working group Discussion of this draft takes place on the HTTP working group
mailing list (ietf-http-wg@w3.org), which is archived at mailing list (ietf-http-wg@w3.org), which is archived at
https://lists.w3.org/Archives/Public/ietf-http-wg/ [1]. https://lists.w3.org/Archives/Public/ietf-http-wg/ [1].
Working Group information can be found at http://httpwg.github.io/ Working Group information can be found at http://httpwg.github.io/
[2]; source code and issues list for this draft can be found at [2]; source code and issues list for this draft can be found at
https://github.com/httpwg/http-extensions/labels/client-cert-header https://github.com/httpwg/http-extensions/labels/client-cert-field
[3]. [3].
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on December 10, 2021. This Internet-Draft will expire on March 17, 2022.
Copyright Notice Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 50 skipping to change at page 2, line 50
authentication is sometimes employed and in such cases the origin authentication is sometimes employed and in such cases the origin
server often requires information about the client certificate for server often requires information about the client certificate for
its application logic. Such logic might include access control its application logic. Such logic might include access control
decisions, audit logging, and binding issued tokens or cookies to a decisions, audit logging, and binding issued tokens or cookies to a
certificate, and the respective validation of such bindings. The certificate, and the respective validation of such bindings. The
specific details from the certificate needed also vary with the specific details from the certificate needed also vary with the
application requirements. In order for these types of application application requirements. In order for these types of application
deployments to work in practice, the reverse proxy needs to convey deployments to work in practice, the reverse proxy needs to convey
information about the client certificate to the origin application information about the client certificate to the origin application
server. A common way this information is conveyed in practice today server. A common way this information is conveyed in practice today
is by using non-standard headers to carry the certificate (in some is by using non-standard fields to carry the certificate (in some
encoding) or individual parts thereof in the HTTP request that is encoding) or individual parts thereof in the HTTP request that is
dispatched to the origin server. This solution works but dispatched to the origin server. This solution works but
interoperability between independently developed components can be interoperability between independently developed components can be
cumbersome or even impossible depending on the implementation choices cumbersome or even impossible depending on the implementation choices
respectively made (like what header names are used or are respectively made (like what field names are used or are
configurable, which parts of the certificate are exposed, or how the configurable, which parts of the certificate are exposed, or how the
certificate is encoded). A well-known predictable approach to this certificate is encoded). A well-known predictable approach to this
commonly occurring functionality could improve and simplify commonly occurring functionality could improve and simplify
interoperability between independent implementations. interoperability between independent implementations.
This document aspires to standardize an HTTP header field named This document aspires to standardize an HTTP header field named
"Client-Cert" that a TLS terminating reverse proxy (TTRP) adds to "Client-Cert" that a TLS terminating reverse proxy (TTRP) adds to
requests that it sends to the backend origin servers. The header requests that it sends to the backend origin servers. The field
value contains the client certificate from the mutually-authenticated value contains the client certificate from the mutually-authenticated
TLS connection between the originating client and the TTRP. This TLS connection between the originating client and the TTRP. This
enables the backend origin server to utilize the client certificate enables the backend origin server to utilize the client certificate
information in its application logic. While there may be additional information in its application logic. While there may be additional
proxies or hops between the TTRP and the origin server (potentially proxies or hops between the TTRP and the origin server (potentially
even with mutually-authenticated TLS connections between them), the even with mutually-authenticated TLS connections between them), the
scope of the "Client-Cert" header is intentionally limited to scope of the "Client-Cert" header field is intentionally limited to
exposing to the origin server the certificate that was presented by exposing to the origin server the certificate that was presented by
the originating client in its connection to the TTRP. the originating client in its connection to the TTRP.
1.1. Requirements Notation and Conventions 1.1. Requirements Notation and Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP "OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here. capitals, as shown here.
skipping to change at page 3, line 46 skipping to change at page 3, line 46
authenticated TLS are used throughout this document to refer to the authenticated TLS are used throughout this document to refer to the
process whereby, in addition to the normal TLS server authentication process whereby, in addition to the normal TLS server authentication
with a certificate, a client presents its X.509 certificate [RFC5280] with a certificate, a client presents its X.509 certificate [RFC5280]
and proves possession of the corresponding private key to a server and proves possession of the corresponding private key to a server
when negotiating a TLS connection or the resumption of such a when negotiating a TLS connection or the resumption of such a
connection. In contemporary versions of TLS [RFC8446] [RFC5246] this connection. In contemporary versions of TLS [RFC8446] [RFC5246] this
requires that the client send the Certificate and CertificateVerify requires that the client send the Certificate and CertificateVerify
messages during the handshake and for the server to verify the messages during the handshake and for the server to verify the
CertificateVerify and Finished messages. CertificateVerify and Finished messages.
TODO: HTTP2 forbids TLS renegotiation and post-handshake
authentication but it's possible with HTTP1.1 and maybe needs to
be discussed explicitly here or somewhere in this document?
Naively I'd say that the "Client-Cert" header will be sent with
the data of the most recent client cert anytime after
renegotiation or post-handshake auth. And only for requests that
are fully covered by the cert but that in practice making the
determination of where exactly in the application data the cert
messages arrived is hard to impossible so it'll be a best effort
kind of thing.
2. HTTP Header Field and Processing Rules 2. HTTP Header Field and Processing Rules
2.1. Encoding 2.1. Encoding
The field-values of the HTTP header defined herein utilize the The field-values of the HTTP header field defined herein utilize the
following encoded form. following encoded form.
A certificate is represented in text as an "EncodedCertificate", A certificate is represented in text as an "EncodedCertificate",
which is the base64-encoded (Section 4 of [RFC4648]) DER which is the base64-encoded (Section 4 of [RFC4648]) DER
[ITU.X690.1994] PKIX certificate. The encoded value MUST NOT include [ITU.X690.1994] PKIX certificate. The encoded value MUST NOT include
any line breaks, whitespace, or other additional characters. ABNF any line breaks, whitespace, or other additional characters. ABNF
[RFC5234] syntax for "EncodedCertificate" is shown in the figure [RFC5234] syntax for "EncodedCertificate" is shown in the figure
below. below.
EncodedCertificate = 1*( DIGIT / ALPHA / "+" / "/" ) 0*2"=" EncodedCertificate = 1*( DIGIT / ALPHA / "+" / "/" ) 0*2"="
skipping to change at page 4, line 39 skipping to change at page 4, line 32
In the context of a TLS terminating reverse proxy (TTRP) deployment, In the context of a TLS terminating reverse proxy (TTRP) deployment,
the TTRP makes the TLS client certificate available to the backend the TTRP makes the TLS client certificate available to the backend
application with the following header field. application with the following header field.
Client-Cert: The end-entity client certificate as an Client-Cert: The end-entity client certificate as an
"EncodedCertificate" value. "EncodedCertificate" value.
The "Client-Cert" header field defined herein is only for use in HTTP The "Client-Cert" header field defined herein is only for use in HTTP
requests and MUST NOT be used in HTTP responses. It is a single HTTP requests and MUST NOT be used in HTTP responses. It is a single HTTP
header field-value as defined in Section 3.2 of [RFC7230], which MUST header field value as defined in Section 3.2 of [RFC7230], which MUST
NOT have a list of values or occur multiple times in a request. NOT have a list of values or occur multiple times in a request.
2.3. Processing Rules 2.3. Processing Rules
This section outlines the applicable processing rules for a TLS This section outlines the applicable processing rules for a TLS
terminating reverse proxy (TTRP) that has negotiated a mutually- terminating reverse proxy (TTRP) that has negotiated a mutually-
authenticated TLS connection to convey the client certificate from authenticated TLS connection to convey the client certificate from
that connection to the backend origin servers. Use of the technique that connection to the backend origin servers. Use of the technique
is to be a configuration or deployment option and the processing is to be a configuration or deployment option and the processing
rules described herein are for servers operating with that option rules described herein are for servers operating with that option
skipping to change at page 5, line 15 skipping to change at page 5, line 8
A TTRP negotiates the use of a mutually-authenticated TLS connection A TTRP negotiates the use of a mutually-authenticated TLS connection
with the client, such as is described in [RFC8446] or [RFC5246], and with the client, such as is described in [RFC8446] or [RFC5246], and
validates the client certificate per its policy and trusted validates the client certificate per its policy and trusted
certificate authorities. Each HTTP request on the underlying TLS certificate authorities. Each HTTP request on the underlying TLS
connection are dispatched to the origin server with the following connection are dispatched to the origin server with the following
modifications: modifications:
1. The client certificate is be placed in the "Client-Cert" header 1. The client certificate is be placed in the "Client-Cert" header
field of the dispatched request as defined in Section 2.2. field of the dispatched request as defined in Section 2.2.
2. Any occurrence of the "Client-Cert" header in the original 2. Any occurrence of the "Client-Cert" header field in the original
incoming request MUST be removed or overwritten before forwarding incoming request MUST be removed or overwritten before forwarding
the request. An incoming request that has a "Client-Cert" header the request. An incoming request that has a "Client-Cert" header
MAY be rejected with an HTTP 400 response. field MAY be rejected with an HTTP 400 response.
Requests made over a TLS connection where the use of client Requests made over a TLS connection where the use of client
certificate authentication was not negotiated MUST be sanitized by certificate authentication was not negotiated MUST be sanitized by
removing any and all occurrences "Client-Cert" header field prior to removing any and all occurrences "Client-Cert" header field prior to
dispatching the request to the backend server. dispatching the request to the backend server.
Backend origin servers may then use the "Client-Cert" header of the Backend origin servers may then use the "Client-Cert" header field of
request to determine if the connection from the client to the TTRP the request to determine if the connection from the client to the
was mutually-authenticated and, if so, the certificate thereby TTRP was mutually-authenticated and, if so, the certificate thereby
presented by the client. presented by the client.
Forward proxies and other intermediaries MUST NOT add the "Client- Forward proxies and other intermediaries MUST NOT add the "Client-
Cert" header to requests, or modify an existing "Client-Cert" header. Cert" header field to requests, or modify an existing "Client-Cert"
Similarly, clients MUST NOT employ the "Client-Cert" header in header field. Similarly, clients MUST NOT employ the "Client-Cert"
requests. header field in requests.
A server that receives a request with a "Client-Cert" header value A server that receives a request with a "Client-Cert" header field
that it considers to be too large can respond with an HTTP 431 status value that it considers to be too large can respond with an HTTP 431
code per Section 5 of [RFC6585]. status code per Section 5 of [RFC6585].
3. Security Considerations 3. Security Considerations
The header described herein enable a TTRP and backend or origin The header field described herein enable a TTRP and backend or origin
server to function together as though, from the client's perspective, server to function together as though, from the client's perspective,
they are a single logical server side deployment of HTTPS over a they are a single logical server side deployment of HTTPS over a
mutually-authenticated TLS connection. Use of the "Client-Cert" mutually-authenticated TLS connection. Use of the "Client-Cert"
header outside that intended use case, however, may undermine the header field outside that intended use case, however, may undermine
protections afforded by TLS client certificate authentication. the protections afforded by TLS client certificate authentication.
Therefore steps MUST be taken to prevent unintended use, both in Therefore steps MUST be taken to prevent unintended use, both in
sending the header and in relying on its value. sending the header field and in relying on its value.
Producing and consuming the "Client-Cert" header SHOULD be a Producing and consuming the "Client-Cert" header field SHOULD be a
configurable option, respectively, in a TTRP and backend server (or configurable option, respectively, in a TTRP and backend server (or
individual application in that server). The default configuration individual application in that server). The default configuration
for both should be to not use the "Client-Cert" header thus requiring for both should be to not use the "Client-Cert" header field thus
an "opt-in" to the functionality. requiring an "opt-in" to the functionality.
In order to prevent header injection, backend servers MUST only In order to prevent field injection, backend servers MUST only accept
accept the "Client-Cert" header from a trusted TTRP (or other proxy the "Client-Cert" header field from a trusted TTRP (or other proxy in
in a trusted path from the TTRP). A TTRP MUST sanitize the incoming a trusted path from the TTRP). A TTRP MUST sanitize the incoming
request before forwarding it on by removing or overwriting any request before forwarding it on by removing or overwriting any
existing instances of the header. Otherwise arbitrary clients can existing instances of the field. Otherwise arbitrary clients can
control the header value as seen and used by the backend server. It control the field value as seen and used by the backend server. It
is important to note that neglecting to prevent header injection does is important to note that neglecting to prevent field injection does
not "fail safe" in that the nominal functionality will still work as not "fail safe" in that the nominal functionality will still work as
expected even when malicious actions are possible. As such, extra expected even when malicious actions are possible. As such, extra
care is recommended in ensuring that proper header sanitation is in care is recommended in ensuring that proper field sanitation is in
place. place.
The communication between a TTRP and backend server needs to be The communication between a TTRP and backend server needs to be
secured against eavesdropping and modification by unintended parties. secured against eavesdropping and modification by unintended parties.
The configuration options and request sanitization are necessarily The configuration options and request sanitization are necessarily
functionally of the respective servers. The other requirements can functionally of the respective servers. The other requirements can
be met in a number of ways, which will vary based on specific be met in a number of ways, which will vary based on specific
deployments. The communication between a TTRP and backend or origin deployments. The communication between a TTRP and backend or origin
server, for example, might be authenticated in some way with the server, for example, might be authenticated in some way with the
insertion and consumption of the "Client-Cert" header occurring only insertion and consumption of the "Client-Cert" field occurring only
on that connection. Alternatively the network topology might dictate on that connection. Alternatively the network topology might dictate
a private network such that the backend application is only able to a private network such that the backend application is only able to
accept requests from the TTRP and the proxy can only make requests to accept requests from the TTRP and the proxy can only make requests to
that server. Other deployments that meet the requirements set forth that server. Other deployments that meet the requirements set forth
herein are also possible. herein are also possible.
4. IANA Considerations 4. IANA Considerations
TODO: register the "Client-Cert" HTTP header field in the registry The "Client-Cert" HTTP header field will be added to the registry
defined by http-core. defined by http-core.
5. References 5. References
5.1. Normative References 5.1. Normative References
[ITU.X690.1994] [ITU.X690.1994]
International Telecommunications Union, "Information International Telecommunications Union, "Information
Technology - ASN.1 encoding rules: Specification of Basic Technology - ASN.1 encoding rules: Specification of Basic
Encoding Rules (BER), Canonical Encoding Rules (CER) and Encoding Rules (BER), Canonical Encoding Rules (CER) and
Distinguished Encoding Rules (DER)", ITU-T Recommendation Distinguished Encoding Rules (DER)", ITU-T Recommendation
skipping to change at page 8, line 5 skipping to change at page 7, line 40
[RFC7230] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer [RFC7230] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
Protocol (HTTP/1.1): Message Syntax and Routing", Protocol (HTTP/1.1): Message Syntax and Routing",
RFC 7230, DOI 10.17487/RFC7230, June 2014, RFC 7230, DOI 10.17487/RFC7230, June 2014,
<https://www.rfc-editor.org/info/rfc7230>. <https://www.rfc-editor.org/info/rfc7230>.
[RFC7239] Petersson, A. and M. Nilsson, "Forwarded HTTP Extension", [RFC7239] Petersson, A. and M. Nilsson, "Forwarded HTTP Extension",
RFC 7239, DOI 10.17487/RFC7239, June 2014, RFC 7239, DOI 10.17487/RFC7239, June 2014,
<https://www.rfc-editor.org/info/rfc7239>. <https://www.rfc-editor.org/info/rfc7239>.
[RFC7250] Wouters, P., Ed., Tschofenig, H., Ed., Gilmore, J.,
Weiler, S., and T. Kivinen, "Using Raw Public Keys in
Transport Layer Security (TLS) and Datagram Transport
Layer Security (DTLS)", RFC 7250, DOI 10.17487/RFC7250,
June 2014, <https://www.rfc-editor.org/info/rfc7250>.
[RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol [RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol
Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
<https://www.rfc-editor.org/info/rfc8446>. <https://www.rfc-editor.org/info/rfc8446>.
[RFC8705] Campbell, B., Bradley, J., Sakimura, N., and T. [RFC8705] Campbell, B., Bradley, J., Sakimura, N., and T.
Lodderstedt, "OAuth 2.0 Mutual-TLS Client Authentication Lodderstedt, "OAuth 2.0 Mutual-TLS Client Authentication
and Certificate-Bound Access Tokens", RFC 8705, and Certificate-Bound Access Tokens", RFC 8705,
DOI 10.17487/RFC8705, February 2020, DOI 10.17487/RFC8705, February 2020,
<https://www.rfc-editor.org/info/rfc8705>. <https://www.rfc-editor.org/info/rfc8705>.
[RFC8941] Nottingham, M. and P-H. Kamp, "Structured Field Values for
HTTP", RFC 8941, DOI 10.17487/RFC8941, February 2021,
<https://www.rfc-editor.org/info/rfc8941>.
5.3. URIs 5.3. URIs
[1] https://lists.w3.org/Archives/Public/ietf-http-wg/ [1] https://lists.w3.org/Archives/Public/ietf-http-wg/
[2] http://httpwg.github.io/ [2] http://httpwg.github.io/
[3] https://github.com/httpwg/http-extensions/labels/client-cert- [3] https://github.com/httpwg/http-extensions/labels/client-cert-
header field
[4] https://datatracker.ietf.org/meeting/106/materials/slides-106- [4] https://datatracker.ietf.org/meeting/106/materials/slides-106-
secdispatch-securing-protocols-between-proxies-and-backend-http- secdispatch-securing-protocols-between-proxies-and-backend-http-
servers-00 servers-00
[5] https://datatracker.ietf.org/meeting/106/materials/minutes- [5] https://datatracker.ietf.org/meeting/106/materials/minutes-
106-secdispatch 106-secdispatch
Appendix A. Example Appendix A. Example
In a hypothetical example where a TLS client presents the client and In a hypothetical example where a TLS client presents the client and
intermediate certificate from Figure 1 when establishing a mutually- intermediate certificate from Figure 1 when establishing a mutually-
authenticated TLS connection with the TTRP, the proxy would send the authenticated TLS connection with the TTRP, the proxy would send the
"Client-Cert" header shown in {#example-header} to the backend. Note "Client-Cert" field shown in {#example-header} to the backend. Note
that line breaks and whitespace have been added to the value of the that line breaks and whitespace have been added to the field value in
header field in Figure 2 for display and formatting purposes only. Figure 2 for display and formatting purposes only.
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIBqDCCAU6gAwIBAgIBBzAKBggqhkjOPQQDAjA6MRswGQYDVQQKDBJMZXQncyBB MIIBqDCCAU6gAwIBAgIBBzAKBggqhkjOPQQDAjA6MRswGQYDVQQKDBJMZXQncyBB
dXRoZW50aWNhdGUxGzAZBgNVBAMMEkxBIEludGVybWVkaWF0ZSBDQTAeFw0yMDAx dXRoZW50aWNhdGUxGzAZBgNVBAMMEkxBIEludGVybWVkaWF0ZSBDQTAeFw0yMDAx
MTQyMjU1MzNaFw0yMTAxMjMyMjU1MzNaMA0xCzAJBgNVBAMMAkJDMFkwEwYHKoZI MTQyMjU1MzNaFw0yMTAxMjMyMjU1MzNaMA0xCzAJBgNVBAMMAkJDMFkwEwYHKoZI
zj0CAQYIKoZIzj0DAQcDQgAE8YnXXfaUgmnMtOXU/IncWalRhebrXmckC8vdgJ1p zj0CAQYIKoZIzj0DAQcDQgAE8YnXXfaUgmnMtOXU/IncWalRhebrXmckC8vdgJ1p
5Be5F/3YC8OthxM4+k1M6aEAEFcGzkJiNy6J84y7uzo9M6NyMHAwCQYDVR0TBAIw 5Be5F/3YC8OthxM4+k1M6aEAEFcGzkJiNy6J84y7uzo9M6NyMHAwCQYDVR0TBAIw
ADAfBgNVHSMEGDAWgBRm3WjLa38lbEYCuiCPct0ZaSED2DAOBgNVHQ8BAf8EBAMC ADAfBgNVHSMEGDAWgBRm3WjLa38lbEYCuiCPct0ZaSED2DAOBgNVHQ8BAf8EBAMC
BsAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0RAQH/BBMwEYEPYmRjQGV4YW1w BsAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0RAQH/BBMwEYEPYmRjQGV4YW1w
bGUuY29tMAoGCCqGSM49BAMCA0gAMEUCIBHda/r1vaL6G3VliL4/Di6YK0Q6bMje bGUuY29tMAoGCCqGSM49BAMCA0gAMEUCIBHda/r1vaL6G3VliL4/Di6YK0Q6bMje
skipping to change at page 10, line 15 skipping to change at page 10, line 15
Client-Cert: MIIBqDCCAU6gAwIBAgIBBzAKBggqhkjOPQQDAjA6MRswGQYDVQQKDBJM Client-Cert: MIIBqDCCAU6gAwIBAgIBBzAKBggqhkjOPQQDAjA6MRswGQYDVQQKDBJM
ZXQncyBBdXRoZW50aWNhdGUxGzAZBgNVBAMMEkxBIEludGVybWVkaWF0ZSBDQTAeFw0y ZXQncyBBdXRoZW50aWNhdGUxGzAZBgNVBAMMEkxBIEludGVybWVkaWF0ZSBDQTAeFw0y
MDAxMTQyMjU1MzNaFw0yMTAxMjMyMjU1MzNaMA0xCzAJBgNVBAMMAkJDMFkwEwYHKoZI MDAxMTQyMjU1MzNaFw0yMTAxMjMyMjU1MzNaMA0xCzAJBgNVBAMMAkJDMFkwEwYHKoZI
zj0CAQYIKoZIzj0DAQcDQgAE8YnXXfaUgmnMtOXU/IncWalRhebrXmckC8vdgJ1p5Be5 zj0CAQYIKoZIzj0DAQcDQgAE8YnXXfaUgmnMtOXU/IncWalRhebrXmckC8vdgJ1p5Be5
F/3YC8OthxM4+k1M6aEAEFcGzkJiNy6J84y7uzo9M6NyMHAwCQYDVR0TBAIwADAfBgNV F/3YC8OthxM4+k1M6aEAEFcGzkJiNy6J84y7uzo9M6NyMHAwCQYDVR0TBAIwADAfBgNV
HSMEGDAWgBRm3WjLa38lbEYCuiCPct0ZaSED2DAOBgNVHQ8BAf8EBAMCBsAwEwYDVR0l HSMEGDAWgBRm3WjLa38lbEYCuiCPct0ZaSED2DAOBgNVHQ8BAf8EBAMCBsAwEwYDVR0l
BAwwCgYIKwYBBQUHAwIwHQYDVR0RAQH/BBMwEYEPYmRjQGV4YW1wbGUuY29tMAoGCCqG BAwwCgYIKwYBBQUHAwIwHQYDVR0RAQH/BBMwEYEPYmRjQGV4YW1wbGUuY29tMAoGCCqG
SM49BAMCA0gAMEUCIBHda/r1vaL6G3VliL4/Di6YK0Q6bMjeSkC3dFCOOB8TAiEAx/kH SM49BAMCA0gAMEUCIBHda/r1vaL6G3VliL4/Di6YK0Q6bMjeSkC3dFCOOB8TAiEAx/kH
SB4urmiZ0NX5r5XarmPk0wmuydBVoU4hBVZ1yhk= SB4urmiZ0NX5r5XarmPk0wmuydBVoU4hBVZ1yhk=
Figure 2: Header in HTTP Request to Origin Server Figure 2: Header Field in HTTP Request to Origin Server
Appendix B. Considerations Considered Appendix B. Considerations Considered
B.1. Header Injection B.1. Field Injection
This draft requires that the TTRP sanitize the headers of the This draft requires that the TTRP sanitize the fields of the incoming
incoming request by removing or overwriting any existing instances of request by removing or overwriting any existing instances of the
the "Client-Cert" header before dispatching that request to the "Client-Cert" header field before dispatching that request to the
backend application. Otherwise, a client could inject its own backend application. Otherwise, a client could inject its own
"Client-Cert" header that would appear to the backend to have come "Client-Cert" field that would appear to the backend to have come
from the TTRP. Although numerous other methods of detecting/ from the TTRP. Although numerous other methods of detecting/
preventing header injection are possible; such as the use of a unique preventing field injection are possible; such as the use of a unique
secret value as part of the header name or value or the application secret value as part of the field name or value or the application of
of a signature, HMAC, or AEAD, there is no common general a signature, HMAC, or AEAD, there is no common general standardized
standardized mechanism. The potential problem of client header mechanism. The potential problem of client field injection is not at
injection is not at all unique to the functionality of this draft and all unique to the functionality of this draft and it would therefor
it would therefor be inappropriate for this draft to define a one-off be inappropriate for this draft to define a one-off solution. In the
solution. In the absence of a generic standardized solution existing absence of a generic standardized solution existing currently,
currently, stripping/sanitizing the headers is the de facto means of stripping/sanitizing the fields is the de facto means of protecting
protecting against header injection in practice today. Sanitizing against field injection in practice today. Sanitizing the fields is
the headers is sufficient when properly implemented and is normative sufficient when properly implemented and is a normative requirement
requirement of Section 3. of Section 3.
B.2. The Forwarded HTTP Extension B.2. The Forwarded HTTP Extension
The "Forwarded" HTTP header field defined in [RFC7239] allows proxy The "Forwarded" HTTP header field defined in [RFC7239] allows proxy
components to disclose information lost in the proxying process. The components to disclose information lost in the proxying process. The
TLS client certificate information of concern to this draft could TLS client certificate information of concern to this draft could
have been communicated with an extension parameter to the "Forwarded" have been communicated with an extension parameter to the "Forwarded"
header field, however, doing so would have had some disadvantages field; however, doing so would have had some disadvantages that this
that this draft endeavored to avoid. The "Forwarded" header syntax draft endeavored to avoid. The "Forwarded" field syntax allows for
allows for information about a full chain of proxied HTTP requests, information about a full chain of proxied HTTP requests, whereas the
whereas the "Client-Cert" header of this document is concerned only "Client-Cert" field of this document is concerned only with conveying
with conveying information about the certificate presented by the information about the certificate presented by the originating client
originating client on the TLS connection to the TTRP (which appears on the TLS connection to the TTRP (which appears as the server from
as the server from that client's perspective) to backend that client's perspective) to backend applications. The multi-hop
applications. The multi-hop syntax of the "Forwarded" header is syntax of the "Forwarded" field is expressive but also more
expressive but also more complicated, which would make processing it complicated, which would make processing it more cumbersome, and more
more cumbersome, and more importantly, make properly sanitizing its importantly, make properly sanitizing its content as required by
content as required by Section 3 to prevent header injection Section 3 to prevent field injection considerably more difficult and
considerably more difficult and error prone. Thus, this draft opted error prone. Thus, this draft opted for the flatter and more
for the flatter and more straightforward structure of a single straightforward structure of a single "Client-Cert" header.
"Client-Cert" header.
B.3. The Whole Certificate and Only the Whole Certificate B.3. The Whole Certificate and Only the Whole Certificate
Different applications will have varying requirements about what Different applications will have varying requirements about what
information from the client certificate is needed, such as the information from the client certificate is needed, such as the
subject and/or issuer distinguished name, subject alternative subject and/or issuer distinguished name, subject alternative
name(s), serial number, subject public key info, fingerprint, etc.. name(s), serial number, subject public key info, fingerprint, etc..
Furthermore some applications, such as "OAuth 2.0 Mutual-TLS Client Furthermore some applications, such as "OAuth 2.0 Mutual-TLS Client
Authentication and Certificate-Bound Access Tokens" [RFC8705], make Authentication and Certificate-Bound Access Tokens" [RFC8705], make
use of the entire certificate. In order to accommodate the latter use of the entire certificate. In order to accommodate the latter
and ensure wide applicability by not trying to cherry-pick particular and ensure wide applicability by not trying to cherry-pick particular
certificate information, this draft opted to pass the full encoded certificate information, this draft opted to pass the full encoded
certificate as the value of the "Client-Cert" header. certificate as the value of the "Client-Cert" field.
The handshake and validation of the client certificate (chain) of the The handshake and validation of the client certificate (chain) of the
mutually-authenticated TLS connection is performed by the TTRP. With mutually-authenticated TLS connection is performed by the TTRP. With
the responsibility of certificate validation falling on the TTRP, the responsibility of certificate validation falling on the TTRP,
only the end-entity certificate is passed to the backend - the root only the end-entity certificate is passed to the backend - the root
Certificate Authority is not included nor are any intermediates. Certificate Authority is not included nor are any intermediates.
TODO: It has been suggested that more information about the
certificate chain might be needed/wanted by the backend
application (to independently evaluate the cert chain, for
example, although that seems like it would be terribly
inefficient) and that any intermediates as well as the root should
also be somehow conveyed, which is an area for further discussion
should this draft progress. One potential approach suggested by a
few folks is to allow some configurability in what is sent along
with maybe a prefix token to indicate what's being sent -
something like "Client-Cert: FULL \<cert> \<intermediate>
\<anchor>" or "Client-Cert: EE \<cert>" as the strawman. Or a
perhaps a parameter or other construct of [RFC8941] to indicate
what's being sent. It's also been suggested that the end-entity
certificate by itself might sometimes be too big (esp. e.g., with
some post-quantum signature schemes). Hard to account for it both
being too much data and not enough data at the same time. But
potentially opening up configuration options to send only specific
attribute(s) from the client certificate is a possibility for
that. In the author's humble opinion the end-entity certificate
by itself strikes a good balance for the vast majority of needs
and avoids optionality. But, again, this is an area for further
discussion should this draft progress.
TODO: It has also been suggested that maybe considerations for
[RFC7250] Raw Public Keys is maybe worth considering. This too is
this is an area for further discussion and consideration should
this draft progress.
Appendix C. Acknowledgements Appendix C. Acknowledgements
The author would like to thank the following individuals who've The author would like to thank the following individuals who've
contributed in various ways ranging from just being generally contributed in various ways ranging from just being generally
supportive of bringing forth the draft to providing specific feedback supportive of bringing forth the draft to providing specific feedback
or content: or content:
o Evan Anderson o Evan Anderson
o Annabelle Backman o Annabelle Backman
 End of changes. 39 change blocks. 
125 lines changed or deleted 74 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/