Subject: Re: [quicwg/base-drafts] address-based access control (#2279)

From: janaiyengar <[email-masked]>
Date: Fri, 04 Jan 2019 17:37:55 -0800

One advice here could be that if a server needs the client to not move to a different IP address, it can simply disable migration via the disable_migration TP. This is a policy decision of course. Does this belong in the applicability draft?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2279#issuecomment-451616559

---

From: ianswett <[email-masked]>
Date: Fri, 04 Jan 2019 18:15:39 -0800

Agreed, if you're doing IP based ACLing, disabling connection migration seems wise.

Otherwise, there's nothing the client can do and the server has to set it's own policy.  Applicability seems like a fine place for this.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2279#issuecomment-451619694

---

From: Kazuho Oku <[email-masked]>
Date: Mon, 07 Jan 2019 22:32:02 -0800

@janaiyengar 
> One advice here could be that if a server needs the client to not move to a different IP address, it can simply disable migration via the disable_migration TP. This is a policy decision of course.

I am not sure if I agree with the framing.

It is often the case that only _some_ of the URIs of an origin applies address-based authentication. I do not think that disallowing migration for the entire origin is the correct solution.

I think it is better to encourage (or requires) HTTP servers to consider "current IP address" as the client address of each HTTP request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2279#issuecomment-452190473