The Prefix Asked for Every Track. The Token Covered Only Some.

Summary

• The 2 November MoQ Privacy Pass working-group draft adds a rule for requests naming a track-namespace prefix. PUBLISH_NAMESPACE, SUBSCRIBE_NAMESPACE and SUBSCRIBE_TRACKS can cover every namespace beginning with that prefix.
• A token scope authorizes the whole request only when its namespace rule is MATCH_PREFIX and its pattern covers the requested prefix. SUBSCRIBE_TRACKS also requires an empty-pattern track-name prefix rule because it can reach any track beneath the branch.
• For the two subscription actions, a relay may accept a narrower scope only if its resulting namespace and publish messages stay within the token's coverage. That alternative is not stated for PUBLISH_NAMESPACE.

A branch is larger than today's leaves

A request for one named media track has an obvious boundary. A request for a prefix names a branch. The new Section 3.3.3 makes the consequence explicit: PUBLISH_NAMESPACE, SUBSCRIBE_NAMESPACE and SUBSCRIBE_TRACKS range over every track namespace beginning with the supplied prefix. A later track under the same branch falls within that request's shape. The July revision had no such section.

That creates a permission mismatch when a Privacy Pass token names a smaller part of the tree. Under the ordinary rule, its namespace_match must be MATCH_PREFIX, and the token's pattern must itself be a prefix of the requested prefix. A narrower pattern cannot authorize the entire branch. For SUBSCRIBE_TRACKS, the track_name_match must also be MATCH_PREFIX with an empty pattern: this operation can subscribe to any track under the namespace prefix. The other two prefix actions do not evaluate a track name because they do not name one.

The draft gives a narrower route to a relay handling SUBSCRIBE_NAMESPACE or SUBSCRIBE_TRACKS. It may accept a limited token if it sends NAMESPACE, NAMESPACE_DONE, PUBLISH and PUBLISH_SKIPPED only for namespaces and tracks inside that token's scope. The relay is then the enforcement point, not a passive forwarder. A resulting PUBLISH is covered by the token presented with SUBSCRIBE_TRACKS; the token is not copied into every outbound PUBLISH. An audit must connect each sent item to the original request and the filtering decision.

Token verification, replay checking and at least one matching scope remain part of the draft's authorization algorithm. The Datatracker record identifies working-group Internet-Draft work, not an RFC. The related MoQ Transport draft is also evolving; the Privacy Pass text marks some transport authentication hooks as open. There is no official deployment count or observed leak in these records.