Subject: Re: Authorization with WWW-Authenticate (bis)

From: Nicolas Alvarez <[email-masked]>
Date: Wed, 11 Nov 2009 16:36:05 -0300

Thomas Broyer wrote:
> http-cookie-auth is totally backwards compatible (except unfortunately
> with Opera pre-10.0, as Opera will then display an error page about
> the auth scheme not being supported);

To avoid this problem again: does the spec say what user agents should do if 
they find an unrecognized auth scheme? (ignore vs fail)

---

From: Thomas Broyer <[email-masked]>
Date: Wed, 11 Nov 2009 22:24:52 +0100

[to the list this time; sorry for the fupe Nicolas]

> they find an unrecognized auth scheme? (ignore vs fail)

In the absence of such a thing in HTTP (or HTTPbis), HTML5 defines the
browsers' expected behavior (ignore):
http://www.whatwg.org/specs/web-apps/current-work/multipage/history.html#navigating-across-documents

-- 
Thomas Broyer
/tɔ.ma.bʁwa.je/

---

From: Henrik Nordstrom <[email-masked]>
Date: Wed, 11 Nov 2009 23:52:08 +0100

> they find an unrecognized auth scheme? (ignore vs fail)

Relevant quote from RFC2617 which is still the authorative document on
this:

   The user agent MUST
   choose to use one of the challenges with the strongest auth-scheme it
   understands and request credentials from the user based upon that
   challenge.

Wording in RFC2617 is not the greatest, but imho it's pretty clear to
anyone reading the document that scheme is extensible with new schemes
and unknown schemes should be ignored by the user agent.

What is unspecified is how the user agent should behave if none of the
provided challenges is understood. It seems to me that most user agents
then fall back on basic auth with unspecified realm which imho is not a
bad thing to do. Both unlikely to be accepted by the server AND exposing
password details in the plain for no good value, better to abort the
request with an error.

Regards
Henrik

---

From: Nicolas Alvarez <[email-masked]>
Date: Wed, 11 Nov 2009 19:54:45 -0300

> password details in the plain for no good value, better to abort the

Your third sentence makes me think you meant "is a bad thing" or "is not a 
good thing" in the second one...

---

From: Thomas Broyer <[email-masked]>
Date: Thu, 12 Nov 2009 00:12:13 +0100

> password details in the plain for no good value, better to abort the

All user agents I tested just displayed the response entity, except
Opera pre-10 which displayed an error page about the auth scheme not
being recognized:
http://hg.ltgt.net/http-cookie-auth/raw-file/tip/ua-compat.html

-- 
Thomas Broyer
/tɔ.ma.bʁwa.je/

---

From: Sylvain Hellegouarch <[email-masked]>
Date: Thu, 12 Nov 2009 20:25:41 +0100

> http://hg.ltgt.net/http-cookie-auth/raw-file/tip/ua-compat.html
Based on the context this scheme would be used (meaning I assume mostly 
along with Ajax), I guess this shouldn't be much of a problem anyway.

- Sylvain

---

From: Thomas Broyer <[email-masked]>
Date: Fri, 13 Nov 2009 01:52:49 +0100

> along with Ajax), I guess this shouldn't be much of a problem anyway.

http-cookie-auth isn't at all limited to AJAX uses!
See http://hg.ltgt.net/http-cookie-auth/raw-file/tip/research.html

There are many frameworks out there where you settle for an auth
mechanism and it gets applied to each and every resource (URL) in your
app (e.g. ASP.NET, Alfresco's WebScripts framework, etc.)

For instance, we're using a custom scheme very similar to Cookie (it
also allows the credentials to be passed in an Authorization header,
for use with... AJAX! yes, AJAX calls use Authorization and cookies
are only used for non-AJAX requests, in our case, the admin section)
in an Enterprise app (this means admins cannot use Opera pre-10, but
we're only actually targeting IE6 only):
Demo AJAX app: https://ubic.atolcd.com/
Demo "web 1.0" admin interface:
https://ubic.atolcd.com/alfresco/us/ubic/admin/ (the login screen is
returned in a 401 response)
(presentation of the project:
http://storage.pardot.com/47721_Alfresco_Case_Study_EADS_Astrium.pdf
or in French: http://www2.alfresco.com/l/1234/2009-11-02/FLDWF/48971_Alfresco_Case_Study_EADS_Astrium_fr.pdf
)

-- 
Thomas Broyer
/tɔ.ma.bʁwa.je/