Token Binding over HTTP
2018
This document describes a collection of mechanisms that allow HTTP
servers to cryptographically bind authentication tokens (such as
cookies and OAuth tokens) to a TLS [RFC5246] connection. We describe
both _first-party_ as well as _federated_ scenarios. In a first-party
scenario, an HTTP server issues a security token (such as a cookie) to
a client, and expects the client to send the security token back to
the server at a later time in order to authenticate. Binding the token
to the TLS connection between client and server protects the security
token from theft, and ensures that the security token can only be used
by the client that it was issued to. Federated token bindings, on the
other hand, allow servers to cryptographically bind security tokens to
a TLS [RFC5246] connection that the client has with a _different_
server than the one issuing the token. This Internet-Draft is a
companion document to The Token Binding Protocol [DraftPopov]
Keywords:
- Correction
- Source
- Cite
- Save
- Machine Reading By IdeaReader
0
References
5
Citations
NaN
KQI