Subject: [quicwg/base-drafts] Document what needs to be checked for address validation (#2125)

From: ekr <[email-masked]>
Date: Wed, 12 Dec 2018 06:45:25 -0800

```
There is no need for a single well-defined format for the token because the
server that generates the token also consumes it.  A token could include
information about the claimed client address (IP and port), a timestamp, and any
other supplementary information the server will need to validate the token in
the future.
```

Unless I'm missing something, we don't actually document or recommend how to validate that a token matches an Initial. I think we should.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2125

---

From: MikkelFJ <[email-masked]>
Date: Wed, 12 Dec 2018 07:08:08 -0800

I'm wondering about the case where a token is received and has expired and is otherwise valid.

There are several cases:

1. injection attack - replay etc.
2. valid token
3. valid token, but expired, based on servers internal algorithm
4. invalid token, fails servers integrity check

Sometimes it makes sense to close a connection, other times it might be more reasonable to ignore the token and force validation within the connection?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2125#issuecomment-446620335

---

From: ekr <[email-masked]>
Date: Wed, 12 Dec 2018 08:35:06 -0800

@mikkelfj: can you make a separate issue for these points?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2125#issuecomment-446653256

---

From: MikkelFJ <[email-masked]>
Date: Wed, 12 Dec 2018 09:58:30 -0800

@ekr #2132

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2125#issuecomment-446682539