Ask servers to limit use of tokens to only once

quicwg · Nov 28, 2018 · baeb987 · baeb987
1 parent 1a93cb8
commit baeb987
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/draft-ietf-quic-transport.md b/draft-ietf-quic-transport.md
@@ -1637,6 +1637,9 @@ able to reuse a token.  To avoid attacks that exploit this property, a server
 can limit its use of tokens to only the information needed validate client
 addresses.
 
+Fraudulently obtained tokens could enable botnets to use servers as amplifiers
+in DDOS attacks. Servers SHOULD protect against such attacks by ensuring that
+tokens are used by clients only once.
 
 ### Address Validation Token Integrity {#token-integrity}