Subject: draft-ietf-httpbis-p7-auth-22, "2.2 Protection Space (Realm)"

From: Julian Reschke <[email-masked]>
Date: Mon, 18 Mar 2013 15:34:10 +0100

Hi there,

while looking into the RFC 2617 Basic issues with I18N of username / 
password, I was reminded that we currently have a missing feature with 
respect to "realm" -- there's no way to put non-ASCII characters here.

This may be perfectly fine for the use of partitioning the protection 
space, but we know that UAs also use the realm when prompting.

Do we need to fix this in HTTPbis? If not, where? Extension spec?

Best regards, Julian

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 19 Mar 2013 07:02:49 +1100

Have you done any testing around what UAs currently do with RFC5987 encoding there, or just UTF-8?

Regards,

On 19/03/2013, at 1:34 AM, Julian Reschke <[email-masked]> wrote:

> Hi there,
> 
> while looking into the RFC 2617 Basic issues with I18N of username / password, I was reminded that we currently have a missing feature with respect to "realm" -- there's no way to put non-ASCII characters here.
> 
> This may be perfectly fine for the use of partitioning the protection space, but we know that UAs also use the realm when prompting.
> 

--
Mark Nottingham   http://www.mnot.net/

---

From: Julian Reschke <[email-masked]>
Date: Mon, 18 Mar 2013 21:46:00 +0100

On 2013-03-18 21:02, Mark Nottingham wrote:
> ...

Apparently they do either ISO-8859-1, or use the UA's locale (see 
discussion on http-auth).

I haven't tried RFC5987, but I'm pretty sure nobody supports it (will 
add test case soonish).

We may want to leave "realm" alone, and instead add something for 
display purposes ("prompt", "name"?).

I don't think this needs to be done in httpbis; we can do it later if 
there happens to be implementer interest.

Best regards, Julian

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 19 Mar 2013 10:05:08 +1100

On 19/03/2013, at 7:46 AM, Julian Reschke <[email-masked]> wrote:

> Apparently they do either ISO-8859-1, or use the UA's locale (see discussion on http-auth).
> 
> I haven't tried RFC5987, but I'm pretty sure nobody supports it (will add test case soonish).
> 
> We may want to leave "realm" alone, and instead add something for display purposes ("prompt", "name"?).
> 
> I don't think this needs to be done in httpbis; we can do it later if there happens to be implementer interest.

+1.

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 20 Mar 2013 01:45:20 +0100

>Do we need to fix this in HTTPbis? If not, where? Extension spec?

HTTP authentication would need a bigger overhaul for this to be useful;
I don't think it's worth spending time on without also doing something
about the bigger usability issues here.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: "Martin J. Dürst" <[email-masked]>
Date: Mon, 25 Mar 2013 18:25:34 +0900

> display purposes ("prompt", "name"?).

I haven't worked this out, and it's not my area of expertise, so I'm 
just writing this up so that it doesn't get forgotten:

If the "realm" and the "display name" are separate, that might lead to 
some subtle security issues (same display name but different realms,...).

Regards,   Martin.

---

From: Julian Reschke <[email-masked]>
Date: Mon, 25 Mar 2013 12:39:55 +0100

> some subtle security issues (same display name but different realms,...).

Indeed. If we did this, we would recommend to always display the realm 
*as well*.

Best regards, Julian