Should PUT-to-create c/r in existing container be allowed with only accessTo Write c/?

[michielbdejong]

The question

Suppose:

• c/ exists
• c/ has its own ACL doc, which looks as follows (leaving out prefix etc):

<#Bob>
  a acl:Authorization;
  acl:agent: <https://bob.com/#me> ;
  acl:accessTo <c/>;
  acl:mode acl:Write.

• c/r does not exist
• Bob (authenticated as https://bob.com/#me) does a PUT to c/r

Note that the Bob's Authorization in the ACL doc of c/ does not contain acl:default, so it does not apply to descendants of c/, only to c/ itself.

Should this request succeed and create c/r?

The facts

• ESS says 'yes'.
• NSS, PSS, and CSS say 'no'.
• For comparison, and in support for 'yes', POST to c/ also only requires accessTo Append, no default permissions required there either.
• But then again, in support of 'no', with a POST the client doesn't get to choose the URL, and with a PUT they do.

Please vote! :)

[michielbdejong]

@timbl @justinwb @dmitrizagidulin @kjetilk @csarven @RubenVerborgh you are in the editorial team, your voice is obviously very welcome in this discussion.

[michielbdejong]

• ESS says 'yes'.

To reproduce this, have a look at https://github.com/solid/web-access-control-tests/tree/reproduce-246-ess

• NSS, PSS, and CSS say 'no'.

To reproduce this, unskip https://github.com/solid/web-access-control-tests/blob/main/test/surface/create.test.ts#L207 and you'll see the CRUD tests still pass against each of these three servers.

[csarven]

Should PUT-to-create c/r in existing container be allowed with only accessTo Write c/?

As only acl:Write is granted to C/ and no access can be determined for C/R, access is denied.

[michielbdejong]

Thanks @csarven! I think we agree on that conclusion.

@acoburn would you be willing to change the ESS behaviour from 'yes' to 'no'?

[michielbdejong]

@acoburn was this fixed in ESS v1.1?

[csarven]

Closing this issue as consensus is deemed to be captured in WAC Editor's Draft: https://solid.github.io/web-access-control-spec/ . See #effective-acl-resource #reading-writing-resources #authorization-matching