RFC 8935

Push-Based Security Event Token (SET) Delivery Using HTTP

📅 published November 2020, from ietf

RFC 8935: Push-Based Security Event Token (SET) Delivery Using HTTP ✨

okay bestie, let's get into it 💖 this one is from the IETF, the Internet Engineering Task Force, the crew that writes the rules for how the internet talks to itself 🌐. It's RFC 8935 and it's a Standards Track document, which means it's an actual official spec and not just someone's opinion 💅. It was published in November 2020 🍂. The editors are A. Backman (Amazon), M. Jones (Microsoft), and M. Scurtescu (Coinbase), with M. Ansari and A. Nadalin also listed as authors (both Independent) 🫶. It has ISSN 2070-1721. Nothing in the title block says it obsoletes or updates another RFC, so it stands on its own 🌸.

The whole idea is giving push notifications for security events 🔥. Instead of the receiver going and asking "anything new?", the sender just sends the Security Event Token straight to the receiver's HTTP endpoint using POST over TLS 🦋. The receiver answers with a success or a failure, and that's the whole conversation ✨.

Also, the spec only covers the push method. The other option, poll-based delivery, lives in [RFC8936] 💜.

Status of This Memo

Okay so this section is the legal-ish bit saying this is a real IETF Standards Track document that went through public review and got approved by the IESG 🎀. If you want more on what Standards Track means, go check Section 2 of RFC 7841, and the current status and errata live at https://www.rfc-editor.org/info/rfc8935 🌈.

Copyright Notice

Copyright (c) 2020 IETF Trust and the document authors, all rights reserved 🔒. This doc is under BCP 78 and the IETF Trust's Legal Provisions, so read those if you're planning to reuse anything. Any Code Components pulled out of this doc have to include Simplified BSD License text (Section 4.e of the Trust Legal Provisions) and come with no warranty 💅.

1.  Introduction and Overview
  1.1.  Notational Conventions
  1.2.  Definitions
2.  SET Delivery
  2.1.  Transmitting a SET
  2.2.  Success Response
  2.3.  Failure Response
  2.4.  Security Event Token Error Codes
3.  Authentication and Authorization
4.  Delivery Reliability
5.  Security Considerations
  5.1.  Authentication Using Signed SETs
  5.2.  HTTP Considerations
  5.3.  Confidentiality of SETs
  5.4.  Denial of Service
  5.5.  Authenticating Persisted SETs
6.  Privacy Considerations
7.  IANA Considerations
  7.1.  Security Event Token Error Codes
    7.1.1.  Registration Template
    7.1.2.  Initial Registry Contents
8.  References
  8.1.  Normative References
  8.2.  Informative References
Appendix A.  Unencrypted Transport Considerations
Acknowledgments
Authors' Addresses

1. Introduction and Overview 🦋

Alright, so this spec defines a way for a transmitter of a Security Event Token (SET) [RFC8417] to deliver that SET to the intended SET Recipient. The delivery is an HTTP POST [RFC7231] sent over TLS 🔐. As mentioned, it's the alternative to the poll-based method in [RFC8936] 💖.

Push-based delivery over HTTP POST is meant for situations where all three of these are true:

The transmitter can make outbound HTTP requests 📤.
The recipient can host a TLS-enabled HTTP endpoint that the transmitter can reach 🌷.
The transmitter and recipient are willing to swap data with each other 🫶.

Sometimes push or poll could work, and sometimes only one of them makes sense 🎀.

Also, swapping config stuff like endpoint URLs, crypto keys, or implementation limits such as buffer sizes is out of scope for this spec, so that's not in here 🙈. How SETs are defined and how security events get identified for recipients is covered in [RFC8417] 💜.

1.1. Notational Conventions

Here's where the capital-letter key words come in 🔥. "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" get read as described in BCP 14 [RFC2119] [RFC8174], but only when they're written in all capitals, like they are here 💅. Lowercase ones are just regular English, bestie.

Also, all the figures might have extra spaces and line wrapping so they fit on the page ✨.

1.2. Definitions

This spec uses the terms "Security Event Token (SET)", "SET Issuer", "SET Recipient", and "Event Payload" from [RFC8417] 🌸. It also defines its own term:

SET Transmitter: an entity that delivers SETs it has to one or more SET Recipients 📦.

2. SET Delivery 💌

So to deliver a SET to a SET Recipient, the SET Transmitter makes a SET Transmission Request and the SET itself rides along inside the request 🚀. The recipient replies, either saying the SET was successfully sent or saying something went wrong while it was receiving, parsing, or validating the SET 😭.

When a SET comes in, the SET Recipient SHALL check that all of these are true 👑:

The SET Recipient can parse the SET.
The SET is authentic. That means it was issued by the issuer named inside the SET, and if it's signed, it was signed by a key that belongs to that issuer 🔑.
The SET Recipient is listed as an intended audience of the SET.
The SET Issuer is one the recipient is willing to take SETs from (like, the issuer is on the allowed list) 📋.
The SET Recipient is willing to accept this SET from this particular SET Transmitter (like, the transmitter is expected to send SETs with that issuer and subject) 🧚.

How the recipient actually does that checking is out of scope for this doc 🙃. Parsing, issuer identification, and audience identification are defined in [RFC8417] 💜. How you validate authenticity depends on the deployment and the auth mechanisms in use, plus whether the SET is signed and/or encrypted (see Section 3) 🔐.

SET Transmitters MAY send SETs that were issued by someone else 📨. The SET Recipient can accept or reject a SET as it likes, and a rejection looks like an error response such as "access_denied" 🙅‍♀️.

The SET Recipient stores the SET in a way that's good enough for its own reliability needs 💾. How long and how it keeps SETs is out of scope for this spec 🌙. Once the SET is validated and stored, the SET Recipient SHOULD immediately send back a response saying it was delivered 🎉. It SHOULD NOT do any more processing beyond the required validation steps before sending that response 🙅‍♀️. Any extra work SHOULD happen asynchronously, so the transmitter isn't stuck waiting around ⏳.

The SET Transmitter MAY send the same SET to the SET Recipient more than once, no matter what response it got before 🔁. The SET Recipient MUST respond as it would if it had never seen that SET before 💅. The SET Recipient MUST NOT expect or count on the transmitter resending a SET, or otherwise making it available again, once the recipient has confirmed it was received successfully 🙈.

The SET Transmitter should not resend a SET unless it suspects an earlier attempt may have failed because of a recoverable error, like a network outage or a temporary service hiccup on either side 🌧️. In every other case, the SET Transmitter SHOULD NOT resend a SET 🚫. When it does retry, the SET Transmitter SHOULD wait an appropriate amount of time so it doesn't overwhelm the SET Recipient (see Section 4) ⏰.

2.1. Transmitting a SET 📤

To send a SET, the SET Transmitter makes an HTTP POST request to a TLS-enabled HTTP endpoint that the SET Recipient provides 🎀. The Content-Type header field of this request MUST be application/secevent+jwt, as defined in Sections 2.3 and 7.2 of [RFC8417] 💖. The Accept header field MUST be application/json 💜. The request body MUST be the SET itself, represented as a JSON Web Token (JWT) [RFC7519] 🫧.

The SET Transmitter MAY include an Accept-Language header field in the request, to tell the SET Recipient which language(s) it would like error messages in 🌍.

How the SET Transmitter figures out which HTTP endpoint to send to, for a given SET Recipient, is not defined here and depends on the deployment 🗺️.

Here's a non-normative example of a SET Transmission Request (so it's just an illustration, not a rule) 🦋:

  POST /Events HTTP/1.1
  Host: notify.rp.example.com
  Accept: application/json
  Accept-Language: en-US, en;q=0.5
  Content-Type: application/secevent+jwt

  eyJ0eXAiOiJzZWNldmVudCtqd3QiLCJhbGciOiJIUzI1NiJ9Cg
  .
  eyJpc3MiOiJodHRwczovL2lkcC5leGFtcGxlLmNvbS8iLCJqdGkiOiI3NTZFNjk
  3MTc1NjUyMDY5NjQ2NTZFNzQ2OTY2Njk2NTcyIiwiaWF0IjoxNTA4MTg0ODQ1LC
  JhdWQiOiI2MzZDNjk2NTZFNzQ1RjY5NjQiLCJldmVudHMiOnsiaHR0cHM6Ly9zY
  2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlzYy9ldmVudC10eXBlL2FjY291
  bnQtZGlzYWJsZWQiOnsic3ViamVjdCI6eyJzdWJqZWN0X3R5cGUiOiJpc3Mtc3V
  iIiwiaXNzIjoiaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vIiwic3ViIjoiNzM3NT
  YyNkE2NTYzNzQifSwicmVhc29uIjoiaGlqYWNraW5nIn19fQ
  .
  Y4rXxMD406P2edv00cr9Wf3_XwNtLjB9n-jTqN1_lLc

Figure 1: Example SET Transmission Request 🧚

2.2. Success Response 🎉

If the SET checks out as valid, the SET Recipient SHALL confirm successful transmission by replying with HTTP status code 202 (Accepted), see Section 6.3.3 of [RFC7231] 🥳. The response body MUST be empty 🫙.

Here's a non-normative example of a successful receipt (again, just an example) 💅:

  HTTP/1.1 202 Accepted

Figure 2: Example Successful Delivery Response 🌸

Part 1 of 4. More parts coming, bestie, so stay tuned 💜✨

2.3. Failure Response 💔

Okay so if something goes wrong at the general HTTP level, the SET Recipient replies with the matching HTTP Status Code, as defined in Section 6 of [RFC7231] ✨

When the SET Recipient hits an error while parsing, validating, or authenticating a SET that came in a SET Transmission Request, the SET Recipient SHALL respond with an HTTP Response Status Code of 400 (Bad Request) 🙅‍♀️ The "Content-Type" header field on that response MUST be "application/json", and the body MUST be a UTF-8 encoded JSON [RFC8259] object with these name/value pairs:

err: A Security Event Token Error Code (see Section 2.4).
description: A UTF-8 string containing a human-readable description of the error that may provide additional diagnostic information. The exact content of this field is implementation specific.

The response MUST include a "Content-Language" header field whose value tells you what language the error descriptions in the body are in 🌍 If the SET Recipient can provide error descriptions in multiple languages, they SHOULD pick the language based on the "Accept-Language" header field the SET Transmitter sent in the transmission request, as described in Section 5.3.5 of [RFC7231]. If the SET Transmitter didn't send an "Accept-Language" header field, or the SET Recipient doesn't support any of the languages in that header, the SET Recipient MUST respond with messages that are understandable by an English-speaking person, as described in Section 4.5 of [RFC2277] 🇬🇧

Here's a non-normative example error response for when the key used to encrypt the SET has been revoked 🔑

  HTTP/1.1 400 Bad Request
  Content-Language: en-US
  Content-Type: application/json

  {
    "err": "invalid_key",
    "description": "Key ID 12345 has been revoked."
  }

Figure 3: Example Error Response (invalid_key)

Next up, a non-normative example for when the access token in the request is expired 🥀

  HTTP/1.1 400 Bad Request
  Content-Language: en-US
  Content-Type: application/json

  {
    "err": "authentication_failed",
    "description": "Access token has expired."
  }

Figure 4: Example Error Response (authentication_failed)

And this non-normative example is for when the SET Receiver isn't willing to accept SETs from this particular SET Transmitter issued by the specified issuer 🚫

HTTP/1.1 400 Bad Request
Content-Language: en-US
Content-Type: application/json

{
  "err": "invalid_issuer",
  "description": "Not authorized for issuer https://iss.example.com/"
}

Figure 5: Example Error Response (access_denied)

2.4. Security Event Token Error Codes 🏷️

Security Event Token Error Codes are strings that name a specific category of error that might come up when parsing or validating a SET 🔍 Every Security Event Token Error Code MUST have a unique name registered in the IANA "Security Event Token Error Codes" registry established by Section 7.1.

Here's the starter set of Error Codes that get registered in the IANA "Security Event Token Error Codes" registry 📋

   +=======================+=====================================+
   | Error Code            | Description                         |
   +=======================+=====================================+
   | invalid_request       | The request body cannot be parsed   |
   |                       | as a SET, or the Event Payload      |
   |                       | within the SET does not conform to  |
   |                       | the event's definition.             |
   +-----------------------+-------------------------------------+
   | invalid_key           | One or more keys used to encrypt or |
   |                       | sign the SET is invalid or          |
   |                       | otherwise unacceptable to the SET   |
   |                       | Recipient (expired, revoked, failed |
   |                       | certificate validation, etc.).      |
   +-----------------------+-------------------------------------+
   | invalid_issuer        | The SET Issuer is invalid for the   |
   |                       | SET Recipient.                      |
   +-----------------------+-------------------------------------+
   | invalid_audience      | The SET Audience does not           |
   |                       | correspond to the SET Recipient.    |
   +-----------------------+-------------------------------------+
   | authentication_failed | The SET Recipient could not         |
   |                       | authenticate the SET Transmitter.   |
   +-----------------------+-------------------------------------+
   | access_denied         | The SET Transmitter is not          |
   |                       | authorized to transmit the SET to   |
   |                       | the SET Recipient.                  |
   +-----------------------+-------------------------------------+

                       Table 1: SET Error Codes

Other Error Codes may also show up, since the list is extensible through the IANA "Security Event Token Error Codes" registry established in Section 7.1 🌈

3. Authentication and Authorization 🔐

The SET delivery method in this specification is built on HTTP over TLS [RFC2818] and standard HTTP authentication and authorization schemes, as per [RFC7235] 🧱 The TLS server certificate MUST be validated using DNS-ID [RFC6125] and/or DNS-Based Authentication of Named Entities (DANE) [RFC6698] 🪪

Whether someone is allowed to send actionable SETs can be figured out from the identity of the SET Issuer, the identity of the SET Transmitter (maybe with mutual TLS), or other authentication methods in use 🤝 Because SETs are not commands, SET Recipients are free to ignore SETs that aren't of interest 🙈

4. Delivery Reliability 🔁

Delivery reliability needs can vary depending on the use case 🎀 This specification defines the response from the SET Recipient so the SET Transmitter has the info it needs to figure out what further action is required, if any, to meet its requirements. SET Transmitters with high reliability requirements might be tempted to always retry failed transmissions 😤 But it should be noted that for many types of SET delivery errors, a retry is extremely unlikely to succeed 💀 For example, "invalid_request" points to a structural error in the request body that will likely still be there when the same SET is retransmitted. Others, like "access_denied", may be transient, for example if the SET Transmitter refreshes expired credentials before retransmitting ✨

The SET Transmitter may not know whether a SET was actually delivered to a SET Recipient 🫠 A network interruption could stop the SET Transmitter from getting the success response, or a service outage could stop it from recording that the SET was delivered. It's left to the implementer to decide how to handle these cases based on their requirements. For example, it may be right for the SET Transmitter to retransmit the SET, erring on the side of guaranteeing delivery. Or it may be right to assume delivery worked, erring on the side of not wasting resources retransmitting SETs that were already delivered 🧠 Other options, like sending the SET to a "dead letter queue" for manual examination, may also be appropriate 📬

Implementers SHOULD evaluate the reliability requirements of their use cases, and the impact of various retry mechanisms and retransmission policies on their systems' performance, to pick a strategy for handling the different error conditions 📊

5. Security Considerations 🛡️

5.1. Authentication Using Signed SETs

JWS signed SETs can be used (see [RFC7515] and Section 5 of [RFC8417]) to let the SET Recipient check that the SET Issuer is authorized to provide actionable SETs 🖊️

5.2. HTTP Considerations

SET delivery depends on Hypertext Transfer Protocol, so it's subject to the security considerations of HTTP (Section 9 of [RFC7230]) and its related specifications 🌐

5.3. Confidentiality of SETs

SETs may contain sensitive information, including Personally Identifiable Information (PII), or be distributed through third parties 😱 In those cases, SET Transmitters and SET Recipients MUST protect the confidentiality of the SET contents. TLS MUST be used to secure the transmitted SETs. In some use cases, encrypting the SET as described in JWE [RFC7516] will also be required 🔒 The Event delivery endpoint MUST support at least TLS version 1.2 [RFC5246] and SHOULD support the newest version of TLS that meets its security requirements, which as of the time of this publication is TLS 1.3 [RFC8446] ⚡ The client MUST perform a TLS/SSL server certificate check using DNS-ID [RFC6125] and/or DANE [RFC6698]. How a SET Transmitter determines the expected service identity to match against the SET Recipient's server certificate is out of scope for this document 🙃 The implementation security considerations for TLS in "Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)" [RFC7525] MUST be followed 🫡

5.4. Denial of Service

The SET Recipient may be vulnerable to a denial-of-service attack, where a malicious party floods it with requests containing invalid SETs, making the endpoint burn significant resources on cryptographic operations that are bound to fail 🚨 One way to mitigate this is authenticating SET Transmitters with a mechanism such as mutual TLS. Rate-limiting problematic transmitters is also a possible means of mitigation 🚦

5.5. Authenticating Persisted SETs

At the time of receipt, the SET Recipient can rely on TLS mechanisms, HTTP authentication methods, and/or other context from the transmission request to authenticate the SET Transmitter and validate the authenticity of the SET ✅ However, that context is typically unavailable to systems the SET Recipient forwards the SET to, or to systems that pull the SET from storage 🗄️ If the SET Recipient needs to validate SET authenticity outside the context of the transmission request, then the SET Recipient SHOULD ensure that such SETs have been signed in accordance with [RFC7515]. Needed context could also be stored with the SET and retrieved along with it 💜

6. Privacy Considerations 🔐✨

Okay bestie, privacy time 🫶 SET Transmitters should attempt to deliver SETs that are targeted to the specific business and protocol needs of subscribers. Make it relevant, make it useful 💅

When you're sharing personally identifiable information, or anything else that's considered confidential to affected users, SET Transmitters and Recipients MUST have the appropriate legal agreements and user consent or terms of service in place. 📜 Then, data that needs confidentiality protection MUST be encrypted, at least with TLS and sometimes also using JSON Web Encryption (JWE) [RFC7516]. No cap, this part is not optional 💀

Sometimes the subject identifiers themselves are sensitive, so putting one inside a SET could count as a privacy violation 🙈 SET Issuers and SET Transmitters should think about what happens when they share a particular subject identifier with a SET Recipient. Could it enable correlation and/or de-anonymization of data? Choose appropriate subject identifiers for the use case, periodt 🦋

7. IANA Considerations 📋🌸

7.1. Security Event Token Error Codes 🚨

This document defines Security Event Token Error Codes, and IANA has created and now maintains a brand new registry for them, titled "Security Event Token Error Codes" 🎀 The initial values for that registry are defined in Table 1 and registered below. Future assignments are made through the Specification Required registration policy [RFC8126], and they shall follow the template below ✨

Error Codes are meant to be read by automated systems, so they SHOULD identify classes of errors that an automated system could respond to in a meaningfully distinct way. Like, maybe by refreshing authentication credentials and retrying the request 🔁 It's giving smart error design.

Error Code names are case sensitive 🔠 Names may not match other registered names in a case-insensitive manner, unless the Designated Experts say there's a compelling reason to allow an exception.

The Designated Experts should look at whether a proposed registration duplicates existing functionality, whether it's likely to be of general applicability or only useful for a single application, and whether the registration description is clear 👀

It's suggested that multiple Designated Experts be appointed, and that they can represent the perspectives of different applications using this specification. That way the review of registration decisions is broadly informed 🌈 And if a registration decision could look like a conflict of interest for a particular expert, that expert should defer to the judgment of the other experts. Fair is fair 🫶

7.1.1. Registration Template 📝

Error Code The name of the Security Event Token Error Code, as described in Section 2.4. The name MUST be a case-sensitive ASCII string consisting only of letters, digits, and underscore. These are the characters whose codes fall within the inclusive ranges 0x30-39, 0x41-5A, 0x5F, and 0x61-7A. 🔤

Description A brief human-readable description of the Security Event Token Error Code. 💬

Change Controller For error codes registered by the IETF or its working groups, list "IETF". For all other error codes, list the name of the party responsible for the registration. Contact information such as a mailing address, email address, or phone number may also be provided 📮

Reference A reference to the document or documents that define the Security Event Token Error Code. The definition MUST specify the name and description of the error code, and it has to explain under what circumstances the error code may be used. URIs that can be used to retrieve copies of each document at no cost SHOULD be included 📚

7.1.2. Initial Registry Contents 🗂️

Error Code:  invalid_request
Description:  The request body cannot be parsed as a SET or the Event
   Payload within the SET does not conform to the event's definition.
Change Controller:  IETF
Reference:  Section 2.4 of RFC 8935

Error Code:  invalid_key
Description:  One or more keys used to encrypt or sign the SET is
   invalid or otherwise unacceptable to the SET Recipient (expired,
   revoked, failed certificate validation, etc.).
Change Controller:  IETF
Reference:  Section 2.4 of RFC 8935

Error Code:  invalid_issuer
Description:  The SET Issuer is invalid for the SET Recipient.
Change Controller:  IETF
Reference:  Section 2.4 of RFC 8935

Error Code:  invalid_audience
Description:  The SET Audience does not correspond to the SET
   Recipient.
Change Controller:  IETF
Reference:  Section 2.4 of RFC 8935

Error Code:  authentication_failed
Description:  The SET Recipient could not authenticate the SET
   Transmitter.
Change Controller:  IETF
Reference:  Section 2.4 of RFC 8935

Error Code:  access_denied
Description:  The SET Transmitter is not authorized to transmit the
   SET to the SET Recipient.
Change Controller:  IETF
Reference:  Section 2.4 of RFC 8935

8. References 📖💜

8.1. Normative References 🧠

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC2277]  Alvestrand, H., "IETF Policy on Character Sets and
           Languages", BCP 18, RFC 2277, DOI 10.17487/RFC2277,
           January 1998, <https://www.rfc-editor.org/info/rfc2277>.

[RFC2818]  Rescorla, E., "HTTP Over TLS", RFC 2818,
           DOI 10.17487/RFC2818, May 2000,
           <https://www.rfc-editor.org/info/rfc2818>.

[RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security
           (TLS) Protocol Version 1.2", RFC 5246,
           DOI 10.17487/RFC5246, August 2008,
           <https://www.rfc-editor.org/info/rfc5246>.

[RFC6125]  Saint-Andre, P. and J. Hodges, "Representation and
           Verification of Domain-Based Application Service Identity
           within Internet Public Key Infrastructure Using X.509
           (PKIX) Certificates in the Context of Transport Layer
           Security (TLS)", RFC 6125, DOI 10.17487/RFC6125, March
           2011, <https://www.rfc-editor.org/info/rfc6125>.

[RFC6698]  Hoffman, P. and J. Schlyter, "The DNS-Based Authentication
           of Named Entities (DANE) Transport Layer Security (TLS)
           Protocol: TLSA", RFC 6698, DOI 10.17487/RFC6698, August
           2012, <https://www.rfc-editor.org/info/rfc6698>.

[RFC7230]  Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
           Protocol (HTTP/1.1): Message Syntax and Routing",
           RFC 7230, DOI 10.17487/RFC7230, June 2014,
           <https://www.rfc-editor.org/info/rfc7230>.

[RFC7231]  Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
           Protocol (HTTP/1.1): Semantics and Content", RFC 7231,
           DOI 10.17487/RFC7231, June 2014,
           <https://www.rfc-editor.org/info/rfc7231>.

[RFC7515]  Jones, M., Bradley, J., and N. Sakimura, "JSON Web
           Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May
           2015, <https://www.rfc-editor.org/info/rfc7515>.

[RFC7516]  Jones, M. and J. Hildebrand, "JSON Web Encryption (JWE)",
           RFC 7516, DOI 10.17487/RFC7516, May 2015,
           <https://www.rfc-editor.org/info/rfc7516>.

[RFC7519]  Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token
           (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015,
           <https://www.rfc-editor.org/info/rfc7519>.

[RFC7525]  Sheffer, Y., Holz, R., and P. Saint-Andre,
           "Recommendations for Secure Use of Transport Layer
           Security (TLS) and Datagram Transport Layer Security
           (DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May
           2015, <https://www.rfc-editor.org/info/rfc7525>.

[RFC8126]  Cotton, M., Leiba, B., and T. Narten, "Guidelines for
           Writing an IANA Considerations Section in RFCs", BCP 26,
           RFC 8126, DOI 10.17487/RFC8126, June 2017,
           <https://www.rfc-editor.org/info/rfc8126>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[RFC8259]  Bray, T., Ed., "The JavaScript Object Notation (JSON) Data
           Interchange Format", STD 90, RFC 8259,
           DOI 10.17487/RFC8259, December 2017,
           <https://www.rfc-editor.org/info/rfc8259>.

[RFC8417]  Hunt, P., Ed., Jones, M., Denniss, W., and M. Ansari,
           "Security Event Token (SET)", RFC 8417,
           DOI 10.17487/RFC8417, July 2018,
           <https://www.rfc-editor.org/info/rfc8417>.

[RFC8446]  Rescorla, E., "The Transport Layer Security (TLS) Protocol
           Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
           <https://www.rfc-editor.org/info/rfc8446>.

8.2. Informative References 💡

[RFC7235]  Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
           Protocol (HTTP/1.1): Authentication", RFC 7235,
           DOI 10.17487/RFC7235, June 2014,
           <https://www.rfc-editor.org/info/rfc7235>.

[RFC8936]  Backman, A., Ed., Jones, M., Ed., Scurtescu, M., Ansari,
           M., and A. Nadalin, "Poll-Based Security Event Token (SET)
           Delivery Using HTTP", RFC 8936, DOI 10.17487/RFC8936,
           November 2020, <https://www.rfc-editor.org/info/rfc8936>.

Appendix A. Unencrypted Transport Considerations 🕵️‍♀️🔒

Earlier versions of this specification made the use of TLS optional, and they described the security and privacy considerations that come from using unencrypted HTTP as the underlying transport. When the working group decided to mandate HTTP over TLS, they also decided to keep those considerations in this non-normative appendix, so nothing got lost 🫶

SETs may contain sensitive information that counts as Personally Identifiable Information (PII). In those cases, SET Transmitters and SET Recipients MUST protect the confidentiality of the SET contents. When TLS is not used, that means the SET MUST be encrypted as described in JWE [RFC7516] 🔐

If SETs were allowed to go over unencrypted channels, some privacy-sensitive information about them could leak, even though the SETs themselves are encrypted 😭 For instance, an attacker may be able to figure out whether or not a SET was accepted, and the reason for its rejection. They may also be able to derive information just by observing the size of the encrypted SET. (Note that even when TLS is used, some information leakage is still possible. Message padding algorithms to prevent side channels remain an open research topic 🧪)

Acknowledgments 🌷💖

The editors would like to thank the members of the SCIM Working Group, who began discussing provisioning events starting with draft-hunt-scim-notify-00 in 2015 🎉 They'd also like to thank Phil Hunt and the other authors of draft-ietf-secevent-delivery-02, which this specification is based on. And a big thank you to the participants in the SecEvents Working Group for their contributions to this specification 🦋

The editors would additionally like to thank the following individuals for their reviews of the specification: Joe Clarke, Roman Danyliw, Vijay Gurbani, Benjamin Kaduk, Erik Kline, Murray Kucherawy, Barry Leiba, Yaron Sheffer, Robert Sparks, Valery Smyslov, Éric Vyncke, and Robert Wilton. Iconic reviewers, all of them 👑✨

Okay so this is the final bit of our RFC 8935 glow-up, and it's just the author list, bestie 🎀✨

Authors' Addresses

Annabelle Backman (editor) 💖 Amazon

Email: richanna@amazon.com

Michael B. Jones (editor) 👑 Microsoft

Email: mbj@microsoft.com URI: https://self-issued.info/

Marius Scurtescu 🦋 Coinbase

Email: marius.scurtescu@coinbase.com

Morteza Ansari 🌸 Independent

Email: morteza@sharppics.com

Anthony Nadalin 🧚 Independent

Email: nadalin@prodigy.net

That's the whole document, periodt! 💅🌈

📦 where this page comes from

ietf: rfc8935 2020-11
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms