Subject: [weirds] Queries and Authentication

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 31 Jul 2013 09:23:11 +0000

A question came up during Saturday's interop event that requires some discussion within the WG: if we have resources that can be accessed by both authenticated an unauthenticated clients and we assume that the returned results may differ depending on authentication status, do we need distinct queries to let the server know when it should return a 401 in response to a GET? The general feel of those in the room was "yes".

A possibility using a domain name example:

domain/example.com?auth=1 (or similar with a query parameter)

We could also do something like this:

domain/example.com/auth

though some might argue that this is a different resource.

Thoughts?

Scott

---

From: Marc Blanchet <[email-masked]>
Date: Wed, 31 Jul 2013 11:31:05 +0200

> A question came up during Saturday's interop event that requires some discussion within the WG: if we have resources that can be accessed by both authenticated an unauthenticated clients and we ass…

my take is that this is a "cache" related issue (different content from the same url) and we shall apply cache related techniques (such as don't cache Http headers or else) instead of going around the problem.

moreover, the parameter semantics would need to be defined, and one has multiple level of authorization and authentication, it becomes pretty specific of the rdap server, while everything else we have been defining has been generic. 

So I think we should be looking into the right "don't cache" mechanism.  

Marc.

> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds