Skip to content

Commit 3e66358

Browse files
authored
Update draft-ietf-httpapi-idempotency-key-header.md
Addressed comments
1 parent 5ad4b92 commit 3e66358

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

draft-ietf-httpapi-idempotency-key-header.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -312,7 +312,7 @@ and users of known security concerns specific to the idempotency keys.
312312
Resource servers that do not implement strong idempotency keys, such as UUIDs, or have appropriate controls to validate the idempotency keys, could be victim to various security attacks from malicious clients:
313313

314314
* When the resource server does not validate the idempotency key in the client request and performs a idempotent cache or persistent store lookup to evaluate the idempotency condition, including the detection of duplicate requests, there can be security attacks, primarily in the form of injection, compromising the server.
315-
* When the resource server does not enforce a stricter format for the idempotency key and allows low entropy keys from clients, in absence of strong authorization mechanisms, an attacker MAY try to fetch idempotent cache entries belonging to other client.
315+
* When the resource server does not enforce a stricter format for the idempotency key and allows low entropy keys from clients, in absence of strong authorization mechanisms, an attacker MAY try to fetch idempotent cache entries belonging to other clients.
316316

317317
To prevent such situations, the specification recommends the following best practices for idempotency key implementation in the resource server.
318318

0 commit comments

Comments
 (0)