Hacker News new | past | comments | ask | show | jobs | submit login

I don’t know what else to say - maybe the macaroonjs documentation is wrong? Full quote:

> nothing stops discharge macaroons from containing embedded first- or third-party caveats for the verifier to consider during verification.

So the user requests discharge tokens on his own, but the discharge tokens have to be verified by _my_ server and might contains nested third-party caveats which I’ll have to verify.




If the discharge has another 3p caveat, then generally you'd have to get that discharged also before sending it to a server.

Either way, in each deployment a server supports a set of caveats that makes sense and rejects others.

Or that's the intention of the original idea (I'm an author of the paper). I can't speak for macaroonjs specifically.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: