Web Bot Auth
charter-ietf-webbotauth-01

[Ballot comment]
I read Paul's comment and had to look in the milestones list to find the sentence he was referencing. If what he mentioned is true, I would have similar concerns about the onus being on the server, and not the bot, for additional information. Can this be clarified?

[Ballot comment]
Hi all,

I support this effort.

I still have a comment about this part:

CURRENT:
  Current solutions (such as IP allowlisting, User-Agent strings, and shared API keys) have significant limitations regarding security, scalability, and manageability.

It might be helpful to have a document (not targeting to be published as RFC) to inventory these limitations and under which conditions these are encountered. Having a commonly agreed set would help assess the new methods and also inform target deployments.

Cheers,
Med

[Ballot comment]
One question I have is on the 2nd deliverable, "mechanism for web servers to request additional bot information". This seems to put the onus on the webserver to process (malicious?) bot information to make future decisions on whether to allow authentication. Why is this not the reverse, eg the bot getting additional information from the webserver and the bots need to go out and get their permission settled to authenticate and be allowed?

[Ballot comment]
Thanks for putting this charter together and updates to clear my previous DISCUSS position. I support the formation of this WG.

I would like to seek some clarifications on the following:

1) What is the difference between the following two that are both out of scope? Can they be combined?
"- Authenticating the end user of a participating client or agent"
"There is significant ongoing work for "agents," where a non-browser client makes requests on an end user's behalf. This effort will focus on authentication of the agent; authentication of the end user is out-of-scope."

2) Regarding this text: "There is significant ongoing work for "agents," where a non-browser client makes requests on an end user's behalf. This effort will focus on authentication of the agent; authentication of the end user is out-of-scope."

Is that ongoing work happening in the IETF or in other SDOs? Can some of them be called out for coordination/liaisons?

3) Regarding this deliverable: "A mechanism for web servers to retrieve more information about a requesting bot via an existing widely-used identifier (such as a domain name, hostname, or URL)."

What kind of document is that expected to be? I ask because the other two deliverables mention the track but this one does not.

Changed charter milestone "Standards track specification(s) describing authentication technique(s) and a means for conveying additional information about bots sent to the IESG", set description to "Standards track specification(s) describing authentication technique(s) sent to the IESG"

[Ballot block]
Thanks for putting this charter together. I support the formation of this WG.

However, I have a concern with the following part of the charter:

Input documents that the Working Group might consider for adoption include:
- draft-meunier-web-bot-auth-architecture
- draft-meunier-http-message-signatures-directory

Placing these 2 documents in the charter might give an impression that the IESG is expressing is a preference for them. I would prefer if the WG follows the usual process to pick the individual documents it wishes to via normal WG consensus.

Note: I am not an expert in this area/topic and the above two documents may actually be an excellent starting point. So, no prejudice for or against those documents.

[Ballot comment]
I would like to seek some clarifications on the following:

1) What is the difference between the following two that are both out of scope? Can they be combined?
"- Authenticating the end user of a participating client or agent"
"There is significant ongoing work for "agents," where a non-browser client makes requests on an end user's behalf. This effort will focus on authentication of the agent; authentication of the end user is out-of-scope."

2) Regarding this text: "There is significant ongoing work for "agents," where a non-browser client makes requests on an end user's behalf. This effort will focus on authentication of the agent; authentication of the end user is out-of-scope."

Is that ongoing work happening in the IETF or in other SDOs? Can some of them be called out for coordination/liaisons?

3) Regarding this deliverable: "A mechanism for web servers to retrieve more information about a requesting bot via an existing widely-used identifier (such as a domain name, hostname, or URL)."

What kind of document is that expected to be? I ask because the other two deliverables mention the track but this one does not.

[Ballot comment]
This work needs to get done, thanks for starting it.

I am also worried about the "A way for web servers to learn more information about the bot" sentence, as providing a secure method for this might overly complicate the simple use case of bot authentication. eg an X.509 extension might bring this "for free", but other solutions not part of the base authentication might not.

[Ballot comment]
Hi all,

I support this effort.

I appreciate that the WG will deliver a document that will provided operational considerations.

I have one comment about this part:

CURRENT:
  Current solutions (such as IP allowlisting, User-Agent strings, and shared API keys) have significant limitations regarding security, scalability, and manageability.

It might be helpful to have a document (not targeting to be published as RFC) to inventory these limitations and under which conditions these are encountered. Having a commonly agreed set would help assess the new methods and also inform target deployments.

Cheers,
Med

[Ballot comment]
Absolutely support the work. This appears to be a very short-lived WG with work getting completed by April 2026. Any reason this could not be done in any existing WG?

[Ballot comment]
I expect this to be a valuable activity.

I was however, unsure what sort of document the following would produce: "A way for web servers to learn more information about the bot,..." or what activity this envisaged for the WG to perform, some clarification would imporve the Charter.

[Ballot comment]
Strong support for this WG, let's hope that it can deliver fast. Nevertheless two comments:

Will `In particular, there is significant activity around so-called agentic use cases` age well ? E.g., in 1 year ?

What is the intended publication status (if any) for `A way for web servers to learn more information`