Captive Portal APIApple Inc.1 Infinite LoopCupertino, California 95014United States of Americatpauly@apple.comCableLabs858 Coal Creek CircleLouisville, CO 80027United States of Americad.thakore@cablelabs.comInternet-DraftThis document describes an HTTP API that allows hosts to interact with a Captive Portal system.This document describes a HyperText Transfer Protocol (HTTP) Application Program Interface (API) that allows hosts to interact with a Captive Portal system. The API defined in this document has been designed to meet the requirements in the Captive Portal Architecture . Specifically, the API provides:The state of captivity (whether or not the host has access to the Internet)A URI that a host’s browser can present to a user to get out of captivityAn encrypted connection (TLS for both the API and portal URI)The Captive Portal Architecture defines three steps of interaction between hosts and a Captive Portal service:Provisioning, in which a host discovers that a network has a captive portal, and learns the URI of the API serverAPI Server interaction, in which a host queries the state of the captive portal and retrieves the necessary information to get out of captivityEnforcement, in which the enforcement device in the network blocks disallowed traffic, and sends ICMP messages to let hosts know they are blocked by the captive portalThis document is focused on the second step. It is assumed that the location of the Captive Portal API server has been discovered by the host as part of the first step. The mechanism for discovering the API Server endpoint is not covered by this document.The URI of the API endpoint MUST be accessed using HTTP over TLS (HTTPS) and SHOULD be served on port 443 .
The host SHOULD NOT assume that the URI for a given network attachment will stay the same, and SHOULD rely on the discovery or provisioning process each time it joins the network. Depending on how the Captive Portal system is configured, the URI may be unique for each host and between sessions for the same host.For example, if the Captive Portal API server is hosted at example.org, the URI’s of the API could be:“https://example.org/captive-portal/api”“https://example.org/captive-portal/api/X54PD”The Captive Portal API data structures are specified in JavaScript Object Notation (JSON) .The following keys are defined at the top-level of the JSON structure returned by the API server:“permitted” (required, boolean): indicates whether or not the Captive Portal is open to the requesting host“hmac-key” (required, string): provides a per-host key that can be used to authenticate messages from the Captive Portal enforcement server“user-portal-url” (required, string): provides the URL of a web portal that can be presented to a user to interact with“expire-date” (optional, string formatted as datetime): indicates the date and time after which the host will be in a captive state“bytes-remaining” (optional, integer): indicates the number of bytes left, after which the host will be in a captive stateNote that the use of the hmac-key is not defined in this document, but is intended for use in the enforcement step of the Captive Portal Architecture.To request the Captive Portal JSON content, a host sends an HTTP GET request:The server then responds with the JSON content for that client:TBD: Provide complete security requirements and analysis.Information passed in this protocol may include a user’s personal information, such as a full name and credit card details. Therefore, it is important that Captive Portal API Servers do not allow access to the Captive Portal API over unecrypted sessions.TBD: NoneThis work in this document was started by Mark Donnelly and Margaret Cullen. Thanks to everyone in the CAPPORT Working Group who has given input.HTTP Over TLSThis memo describes how to use Transport Layer Security (TLS) to secure Hypertext Transfer Protocol (HTTP) connections over the Internet. This memo provides information for the Internet community.Defining Well-Known Uniform Resource Identifiers (URIs)This memo defines a path prefix for "well-known locations", "/.well-known/", in selected Uniform Resource Identifier (URI) schemes. [STANDARDS-TRACK]The JavaScript Object Notation (JSON) Data Interchange FormatJavaScript Object Notation (JSON) is a lightweight, text-based, language-independent data interchange format. It was derived from the ECMAScript Programming Language Standard. JSON defines a small set of formatting rules for the portable representation of structured data.This document removes inconsistencies with other specifications of JSON, repairs specification errors, and offers experience-based interoperability guidance.Date and Time on the Internet: TimestampsCAPPORT ArchitectureThis document aims to document consensus on the CAPPORT architecture. DHCP or Router Advertisements, ICMP, and an HTTP API are used to provide the solution. The role of Provisioning Domains (PvDs) is described.