Channel binding for authentication

[DemiMarie]

The authentication token should be bound to the secure QUIC session in some way.

[EAimTY]

That's a good point, but it is a little tricky to implement. Since quinn doesn't expose any API for obtaining a stable and peers-equivalent parameter, it is difficult to bound token to connection without consuming extra rtt.

[DemiMarie]

That's a good point, but it is a little tricky to implement. Since quinn doesn't expose any API for obtaining a stable and peers-equivalent parameter, it is difficult to bound token to connection without consuming extra rtt.

One option might be to use a hash of the peer’s public key.