Subject: RE: [Simple] Thoughts on uploading authorization documents

From: "Robert Brown" <[email-masked]>
Date: Sun, 10 Jun 2001 18:06:10 -0700

> AUTH sip:[email-masked] SIP/2.0
> Content-Type: application/xml+authdata
> Content-Length: 290

AUTH is simple and flexible.  Both good things.

But is it so flexible that it will end up encouraging the things you're
trying to avoid?  While the description of AUTH is narrow enough to
hopefully discourage abuse, it seems that the semantics of AUTH depend
entirely on the content-type.

I imagine valid AUTH requests like the following two examples may cause
some discomfort...

AUTH sip:[email-masked] SIP/2.0
Content-Type: text/xml+soapenvelope
...
<SOAP-ENV:Envelope
xmlns:SOAP-ENV='http://schemas.xmlsoap.org/soap/envelope/' >
  <SOAP-ENV:Body>
    <DoSomething>
       <param1>
It's unclear whether this method actually does authorization.  But, like
CPL, it does affect the way requests are processed for some URIs, so I
figured this content type is OK too...
       </param1>
    </DoSomething>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

...And having already taken a step on the slippery slope...
 
AUTH sip:[email-masked] SIP/2.0
Content-Type: text/xml+soapenvelope
...
<SOAP-ENV:Envelope
xmlns:SOAP-ENV='http://schemas.xmlsoap.org/soap/envelope/' >
  <SOAP-ENV:Body>
    <UpdateDatabase>
       <prop>foo</prop>
       <value>1234</foo>
    </UpdateDatabase>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

---

From: [email-masked]
Date: Tue, 12 Jun 2001 11:44:20 -0500

> -----Original Message-----
> From: Robert Brown [mailto:[email-masked]]
>
> I imagine valid AUTH requests like the following...
> may cause some discomfort...
> 

If people were stupid enough to do this sort of thing with methods
obviously designed for different purposes, we'd already see this
sort of abuse with, say, REGISTER, INFO, MESSAGE, and NOTIFY.

Oh, wait.

Darn it, Pandora -- where did you put that lid?

/a