W3C home > Mailing lists > Public > public-credentials@w3.org > June 2021

Re: VC HTTP API Endpoint Authz Needs (was: Re: Attempting to block work)

From: Alan Karp <alanhkarp@gmail.com>
Date: Tue, 15 Jun 2021 15:48:24 -0700
Message-ID: <CANpA1Z2GJbEcbwWGm7VBa9ZJeKpNbZVN4CyRneqrAwk=en3jCQ@mail.gmail.com>
To: "Michael Herman (Trusted Digital Web)" <mwherman@parallelspace.net>
Cc: Manu Sporny <msporny@digitalbazaar.com>, Adrian Gropper <agropper@healthurl.com>, W3C Credentials Community Group <public-credentials@w3.org>
On Tue, Jun 15, 2021 at 12:41 PM Michael Herman (Trusted Digital Web) <
mwherman@parallelspace.net> wrote:

> Sideways question: With capability authorizations, is it a "given" that
> the VCA must (😊) be transmitted as part of the inbound transaction (e.g.
> the HTTP request)?
>
Yes.  It's important not to separate designation (which resource you are
invoking) from authorization (which permission you wish to use).

> ...or as an alternate design, can a service endpoint (that
> receives/processes the inbound transactions) alternately query an
> authorization service passing the invoker's identity and the subject
> resource's identity to retrieve the applicable VCA (if it exists)?
>

That doesn't work.  Say that your "friend" Alice asks you to copy a file of
yours, call it A, to a file of hers, call it B.  However, she specifies a
very important file of yours as B.  When you go to write the file, the
service endpoint will find the VCA of yours with write permission and will
clobber file B.  You've just become a confused deputy.

--------------
Alan Karp

>
Received on Tuesday, 15 June 2021 22:50:05 UTC

This archive was generated by hypermail 2.4.0 : Tuesday, 15 June 2021 22:50:08 UTC