Subject: Re: [quicwg/base-drafts] Provide guidelines on token validation (#2132)

From: Martin Thomson <[email-masked]>
Date: Thu, 08 Aug 2019 21:24:54 -0700

I think that we already have most of this.  The text lacks some of the specificity you might desire, but that's the nature of specifications.  For instance, we can't bind NEW_TOKEN to an IP address with a "MUST" in the spec because a server might reasonably identify connections from the same NAT as being equivalent and therefore valid (or it might not, depending on circumstance).

I don't plan to do anything about this issue, but I would entertain a PR that improved the text.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2132#issuecomment-519772077