Subject: [Tools-discuss] ID Submission Tool: I-D Submitter Authentication

From: Julian Reschke <[email-masked]>
Date: Tue, 17 Jun 2008 10:59:10 +0200

Hi,

while submitting drafts this morning, it occurred to me that the current 
approach of authenticating the draft submission based on an HTTP GET 
request violates the GET safeness principle.

Any chance that this could be changed in the future to require a 
subsequent POST (via HTML form)?

BR, Julian
_______________________________________________
Tools-discuss mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tools-discuss

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 17 Jun 2008 11:37:29 +0200

Hi Julian,

> request violates the GET safeness principle.

I assume you mean that a GET on an URL should never change the state of the
resource the URL represents?

If so, that makes sense to me, and resolving another issue raised for
the submission tool would also resolve this: It has been requested that
the confirmation URL shows a web page with the relevant information for
the draft, letting you see and review it before hitting a confirmation
button.

Hmm.  I thought that was in the issue tracker, but can't see it.  I'll
have to add it (to http://www3.tools.ietf.org/tools/ietfdb/report/9) I
guess.

> subsequent POST (via HTML form)?

I think so.  Bill Fenner is currently master of the submission tool
rewrite, so if this happens in the next release is up to him.  Otherwise
we should be able to fix it in a follow-up minor release.

	Henrik

---

From: Julian Reschke <[email-masked]>
Date: Tue, 17 Jun 2008 11:49:34 +0200

Henrik Levkowetz wrote:
>> while submitting drafts this morning, it occurred to me that the 
>> current approach of authenticating the draft submission based on an 
>> HTTP GET request violates the GET safeness principle.
> 
> ...

Exactly.

> have to add it (to http://www3.tools.ietf.org/tools/ietfdb/report/9) I

Thanks a lot.

> ...

BR, Julian