search

tfpauly / privacy-proxy

Specifications for Privacy Proxy Implementations
Other
29 stars 11 forks source link

Meaning of Sec-Token-Request-Blind/Sec-Token-Request-Key dependent on parsing TokenRequest. #201

Closed dvorak42 closed 2 years ago

dvorak42 commented 2 years ago

The parsing of both Sec-Token-Request-Blind and Sec-Token-Request-Key are dependent on the token_type inside the client's TokenRequest, which has a slightly odd layering.

tfpauly commented 2 years ago

Right. I agree that this is odd to have a header that depends on the body — however, in our discussion, I also brought up that the attester needs to look at the token type in the body first anyway, since that's how you know if you're doing the rate-limited version at all. The non-rate-limited types don't have extra headers at all. So, this may not be an issue in practice.