Three client disciplines: fail-closed is an attack-surface list, not a slogan

Reading the Draft · No. 7 · Source: draft-li-rttp-iqa-addressing-00 §1 / §4.5 / §6 · Sister pillars: rttp:// (CRI 27) · iqa:// (CRI 28)

Reviews often ask of any design document: "Are this many client requirements over-engineering?" The merged document's acknowledgements answer it themselves: "The author thanks those who commented on earlier revisions of this document for their attention to the client-behaviour requirements, which are the part of this specification most likely to be misimplemented." The three disciplines are not checklist padding — each one closes a classic attack surface of user-embeddable strings.

Discipline one: no navigation to the URI (Section 4.5.1). The text: "A client MUST NOT use any component of an rttp or iqa URI as a navigation target. A client that renders a link, redirect, or fetch derived from any such URI is an open redirect and is non-conformant." The attack surface: a page embeds an rttp URI and lures the client into treating the authority as a host to visit — the addressing value becomes a hop value; that is an open redirect. The only destination the specification permits is one "fixed in advance by the client itself."

Discipline two: the scheme prefix check (Section 4.5.2). The text: "A protocol handler MUST reject any input whose scheme is neither rttp nor iqa nor the exact scheme name under which that handler was itself registered; without this check it becomes a general-purpose launcher that any page can use to open an arbitrary URI of any scheme." The attack surface: a handler that forwards "unknown scheme to the OS" becomes a launch rail any web page can ride. The prefix check locks the handler to its own scheme.

Discipline three: consent, never silence (Section 4.5.3). The text: "The ability to handle rttp or iqa URIs MUST NOT be acquired without an explicit action by the user, and a client MUST NOT simulate, pre-select, or otherwise bypass that consent." With a privacy rider: "Where the platform exposes the list of registered handlers, that list MUST NOT be exposed to the network." The attack surface: silent registration plus handler-list probing equals a user fingerprint. Consent must be one real user click.

The three disciplines share one underlying position (Section 1): "non-conforming input is rejected, never repaired." Fail-closed is not a style — it is a thesis: a short user-embeddable string will inevitably be fed malicious input, and the only safe policy is to route every unexpected input into an explicit failure.

One line: open redirect, general-purpose launcher, silent fingerprint — three disciplines, three holes sealed; the part most likely to be misimplemented is the part we wrote the most.