RFC 5593
Internet Message Access Protocol (IMAP) - URL Access Identifier Extension
RFC 5593: Internet Message Access Protocol (IMAP) - URL Access Identifier Extension 🦋
okay bestie, this one is RFC 5593 ✨ written by N. Cook over at Cloudmark. it dropped in June 2009 as a Standards Track doc for the Network Working Group, and it updates RFC 5092 (the IMAP URL spec) 💅 so anything that changes in 5092 gets handled here too. now let's get into it 🌸
Status of This Memo
this doc specifies an Internet standards track protocol for the Internet community and asks for discussion and suggestions for improvements 🎀 for the standardization state and status, check the current "Internet Official Protocol Standards" (STD 1) 📖 and distribution of this memo is unlimited 🌈
Copyright Notice
(c) 2009 IETF Trust and the people listed as the document authors 💜 all rights reserved. this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents as they stood on the publication date, which you can find at http://trustee.ietf.org/license-info 📜 please read these carefully because they spell out your rights and restrictions 🙈
Abstract
so IMAP URLs can carry authorization stuff, and RFC 5092 has a list of <access> identifiers and <access> identifier prefixes you can use to lock down URLAUTH-generated URLs 🔐 the problem is none of those identifiers cover newer stuff like streaming 😭 this doc proposes a set of brand new <access> identifiers, plus an IANA mechanism so people can register even more for future apps 🧚
this doc updates RFC 5092 ✨
Table of Contents
1. Introduction ....................................................2
2. Conventions Used in This Document ...............................2
3. Additional Authorized Access Identifiers ........................3
3.1. Existing Access Identifiers ................................3
3.2. Requirement for Additional Access Identifiers ..............3
3.3. Additional Access Identifier Specification .................4
3.4. Defining an Access Identifier for Streaming ................5
4. Formal Syntax ...................................................5
5. Acknowledgements ................................................6
6. IANA Considerations .............................................6
6.1. Access Identifier Registration Template ....................7
6.2. Stream Application Registration ............................7
6.3. Submit Application Registration ............................8
6.4. User Application Registration ..............................8
6.5. Authuser Application Registration ..........................9
6.6. Anonymous Application Registration .........................9
7. Security Considerations .........................................9
8. References .....................................................10
8.1. Normative References ......................................10
8.2. Informative References ....................................101. Introduction ✨
okay so the IMAP URL spec [RFC5092] gives us a way to carry authorization info inside IMAP URLs 🔗 it defines a few authorization <access> identifiers that only let anonymous users, logged-in users, or message submission entities use a URLAUTH-authorized URL 🙋♀️ but here's the tea: there's no defined way to make new <access> identifiers 😤 and bending the existing mechanisms to do that is a security and admin headache 💀
so this doc describes a new <access> identifier called "stream" 🎬 for message streaming entities (as described in [STREAMING]), and it gives an IANA registration template so people can register new <access> identifiers for future apps 🧚 the IANA definitions for the existing identifiers and prefixes from RFC 5092 are also in this doc. this doc updates RFC 5092, and if there's any difference or discrepancy, THIS doc is the master 👑
2. Conventions Used in This Document
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this doc are to be read as described in RFC 2119 [RFC2119] 💖 these are the capital-letter words with real weight, so keep an eye out for them 👀
in examples, "C:" and "S:" mean lines sent by the client and server 💅 if one label covers several lines, some of the line breaks might be just for looks and not part of the actual protocol exchange 🌸
3. Additional Authorized Access Identifiers 🎀
3.1. Existing Access Identifiers
RFC 5092 [RFC5092] already specifies these authorized <access> identifiers:
"authuser"- means this URL is only for authenticated IMAP sessions logged in as any non-anonymous user 🙋♀️"anonymous"- means use of this URL isn't restricted by session authorization identity 🌈
RFC 5092 also defines these <access> identifier prefixes:
submit+- followed by a userid, meaning only a userid authorized as a message submission entity on behalf of that userid can use this URL 📮user+- followed by a userid, meaning use of this URL is limited to IMAP sessions logged in as that specific userid 🫶
3.2. Requirement for Additional Access Identifiers
the existing <access> identifiers work fine for user-based authorization 👍 but only the submit+ prefix works for entities acting on behalf of a user 🤔 generic support for external entities acting on behalf of users is REQUIRED for new services like streaming [STREAMING] 🎬
okay but submit+ isn't good as a general mechanism for granting access to entities acting for users 🙅♀️ here's why:
- Security - the IMAP server keeps a list of submission server entities that are allowed to fetch IMAP URLs with the
submit+prefix 🔒 if you extended that list to include every external entity that could act for users, the attack surface would grow 😱 - Administration - when URLAUTH-style IMAP URLs get presented to an IMAP server by entities acting for users, the server admin can't tell what the URL is for just by looking at the server logs 🕵️♀️
- Resourcing - without a way to tell apart which application an IMAP URL is for, the IMAP server can't prioritize resources for particular apps 📉 for example, the server could prioritize
submit+URL fetch requests over other access identifiers 🙃
3.3. Additional Access Identifier Specification
the last section made it clear that extra <access> identifiers are needed for apps like streaming [STREAMING] that have entities fetching URLAUTH URLs on behalf of users 🎬 this section covers the scope and meaning of those new identifiers ✨
additional <access> identifiers MUST take one of two forms (Section 4 has the formal ABNF syntax) 📐
<access>identifier - the name of the application, like"exampleapp"🧚<access>identifier prefix - the name of the application, like"exampleapp3", followed by a+and then a userid 💜 for example, think aboutexampleapp3+testuser🌸
heads up: an <access> identifier name can also be registered as an <access> identifier prefix 👀 but that would take 2 separate IANA registrations 📝
in both cases the semantics match submit+ 💅 so the <access> identifier, or the <access> identifier prefix (which MUST be followed by a userid), means only a userid authorized as an application entity for that application is allowed to use this URL 🔐 for <access> identifier prefixes, the IMAP server SHALL NOT validate the userid it's given 🙈 BUT it MUST validate that the IMAP session has an authorization identity that's authorized as an application entity for that application 🫶
the application entity itself MAY choose to validate any userid it's given before it tries to retrieve the URL 🌈
the authorization granted by any <access> identifiers used this way is self-describing 🪞 so the IMAP server needs an extensible mechanism for linking userids to new applications ⭐ for example, say a new app called "foo" comes along and needs entities to fetch URLs on behalf of users 🧚 then the IMAP server would need a way to register "foo" and to associate the userids those entities will use with "foo" 💖 any attempt to retrieve URLs containing the <access> identifier "foo" gets checked against the list of userids tied to "foo" ✅
Section 6 has the template you need to register new <access> identifiers or prefixes with IANA 📝
3.4. Defining an Access Identifier for Streaming
one app that uses URLAUTH-authorized URLs is streaming multimedia files that come in as internet-messaging attachments 🎬🍿 that app is described in [STREAMING] 💜
for the IANA registration template for the "stream" <access> identifier, see Section 6.2 🎀
4. Formal Syntax ✨
okay so the grammar section is where things get precise 🤓 the syntax below is written in ABNF (Augmented Backus-Naur Form), the notation from [RFC5234], and it is giving pure structure 💅
ngl the case thing is so relatable: unless it's specifically noted otherwise, all alphabetic characters are case-insensitive 🌸 the capital and lowercase letters in the token strings are only there so humans can read them more easily. implementations MUST accept these strings case-insensitively 🫶 no exceptions bestie, that's a hard rule 🔥
the ABNF below also updates the formal syntax of <access> identifiers that was defined in the IMAP URL spec [RFC5092] 🦋
Copyright (c) 2009 IETF Trust and the persons identified as authors of the code. All rights reserved. 💜
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
- Neither the name of Internet Society, IETF or IETF Trust, nor the names of specific contributors, may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
application = 1*(ALPHA/DIGIT)
access =/ application / (application "+" enc-user)5. Acknowledgements 🙏
okay this one is sweet 🥹 this document was inspired by discussions in the Lemonade Working Group 🍋💖
6. IANA Considerations 📋
IANA created a new registry for IMAP URLAUTH access identifiers and prefixes 🗂️✨
Access identifiers and prefixes MUST be registered using the "IETF Review" policy [RFC5226] 🔒 this section gives the IANA registration entries for the existing access identifiers and prefixes from RFC 5092, plus the entry for the "stream" application 🎀
6.1. Access Identifier Registration Template
here's the template you fill in, bestie 📝
To: iana@iana.org
Subject: IMAP URL Access Identifier Registration
Type: [Either "<access> identifier" or
"<access> identifier prefix"]
Application: [Name of the application, e.g., "stream"]
Description: [A description of the application and its use
of IMAP URLs]
RFC Number: [Number of the RFC in which the application is
defined]
Contact: [Email and/or physical address to contact for
additional information]6.2. Stream Application Registration
the stream one is the main event 🌊
To: iana@iana.org
Subject: IMAP URL Access Identifier Registration
Type: <access> identifier
Application: stream
Description: Used by SIP Media Servers to retrieve
attachments for streaming to email
clients
RFC Number: RFC 5593
Contact: Neil Cook <neil.cook@noware.co.uk>6.3. Submit Application Registration
To: iana@iana.org
Subject: IMAP URL Access Identifier Registration
Type: <access> identifier prefix
Application: submit
Description: Used by message submission entities to
retrieve attachments to be included in
submitted messages
RFC Number: RFC 5593 and RFC 5092
Contact: Lemonade WG <lemonade@ietf.org>6.4. User Application Registration
To: iana@iana.org
Subject: IMAP URL Access Identifier Registration
Type: <access> identifier prefix
Application: user
Description: Used to restrict access to IMAP sessions
that are logged in as the specified userid
RFC Number: RFC 5593 and RFC 5092
Contact: Lemonade WG <lemonade@ietf.org>6.5. Authuser Application Registration
To: iana@iana.org
Subject: IMAP URL Access Identifier Registration
Type: <access> identifier
Application: authuser
Description: Used to restrict access to IMAP sessions
that are logged in as any non-anonymous
user of that IMAP server
RFC Number: RFC 5593 and RFC 5092
Contact: Lemonade WG <lemonade@ietf.org>6.6. Anonymous Application Registration
To: iana@iana.org
Subject: IMAP URL Access Identifier Registration
Type: <access> identifier
Application: anonymous
Description: Indicates that use of this URL is
not restricted by session authorization
identity
RFC Number: RFC 5593 and RFC 5092
Contact: Lemonade WG <lemonade@ietf.org>7. Security Considerations 🚨
okay bestie, this part is SERIOUS 😭 security is not a vibe to skip
the extension to <access> identifiers in this document gives you a way to extend what the "submit+" <access> prefix means, so it can cover arbitrary applications 🔐 the whole point of using these additional <access> identifiers and prefixes is security, specifically stopping "submit+" from getting overloaded into a generic way for entities to retrieve IMAP URLs on behalf of userids 🚫 other than that, the security implications are identical to the ones discussed in Section 10.1 of IMAPURL [RFC5092] 💀
8. References 📚
8.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC5092] Melnikov, A., Ed., and C. Newman, "IMAP URL Scheme", RFC
5092, November 2007.
[RFC5234] Crocker, D., Ed., and P. Overell, "Augmented BNF for
Syntax Specifications: ABNF", STD 68, RFC 5234, January
2008.8.2. Informative References
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226,
May 2008.
[STREAMING] Cook, N., "Streaming Internet Messaging Attachments",
Work in Progress, May 2009.Author's Address
Neil L Cook
Cloudmark
EMail: neil.cook@noware.co.uk📦 where this page comes from
- ietf: rfc5593 2009-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms