Subject: Re: Security Requirements for HTTP, draft -00

From: "Roy T. Fielding" <[email-masked]>
Date: Fri, 1 Feb 2008 12:50:43 -0800

On Jan 28, 2008, at 1:46 PM, Paul Hoffman wrote:
> At 10:27 PM +0100 1/28/08, Stephane Bortzmeyer wrote:
>> On Mon, Jan 28, 2008 at 08:47:46AM -0800,
>>  Paul Hoffman <[email-masked]> wrote
>>  a message of 59 lines which said:
>>
>>>  I strongly suspect that if you add up all the authentications done
>>>  on every HTTP server in the world today, forms+cookies+people would
>>>  win over ((nonforms+people) + (nonforms+nonpeople)).
>>
>> May be, it depends on the metrics you use :-) Number of  
>> installations,
>> number of requests per day, number of US $ processed ? :-)
>
> Number of requests per day.

Not even close.  Regular old HTTP authentication requests outnumber
browser-driven forms-based use of the Web (on a per request basis)
by an order of magnitude.  That's how a lot of services obtain
the news, feeds, stock ticks, catalog updates, price quotes, and
shipping calculations that eventually make it into a single shopping
site's user-oriented page with cookies.

The opinions stated in the draft are wrong and do nothing but obscure
the mechanisms that are supposed to be described.  I suggest you remove
them and rely more on actual examples of authentication as used in HTTP.
A lot of the stuff heard at an IETF meeting is simply old wives tales
retold by folks who don't build application services, let alone the
services that use HTTP.  They should not be relied upon for this draft.

....Roy

---

From: Paul Leach <[email-masked]>
Date: Fri, 1 Feb 2008 14:39:28 -0800

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Roy T. Fielding
Sent: Friday, February 01, 2008 12:51 PM
To: Paul Hoffman
Cc: HTTP Working Group

Not even close.  Regular old HTTP authentication requests outnumber
browser-driven forms-based use of the Web (on a per request basis)
by an order of magnitude.
[Paul Leach] Are you taking into account that, after an FBA, subsequent requests to the same site are authorized by a cookie (i.e., they have no auth headers at all), whereas with Basic every request has an auth header? If not, your statement could be strictly speaking correct, but you'd be using a metric that's different than what other people have in mind as being on a "per request basis".

---

From: "Roy T. Fielding" <[email-masked]>
Date: Fri, 1 Feb 2008 15:17:15 -0800

On Feb 1, 2008, at 2:39 PM, Paul Leach wrote:
> [Paul Leach] Are you taking into account that, after an FBA,  
> subsequent requests to the same site are authorized by a cookie  
> (i.e., they have no auth headers at all), whereas with Basic every  
> request has an auth header?

It doesn't make any difference either way.  The notion that  
authenticated
HTTP requests are almost entirely based on FBA is absurd.  It ignores  
the
fact that most HTTP requests aren't even made by browsers.

....Roy

---

From: Henrik Nordström <[email-masked]>
Date: Tue, 05 Feb 2008 13:42:45 +0100

tis 2008-01-29 klockan 12:18 +1300 skrev Adrien de Croy:

> fundamental design/structure and how it has evolved.  HTTP was initially
> designed to connect, make request, get result and disconnect.  This
> doesn't have room in it for a challenge response auth scheme until you
> move to persistent connections.

Sure it does. Digest is an example of that. Just means that the
authentication session needs to be at the protocol message layer and not
transport connection.

Regards
Henrik