Subject: Re: [Ietf-http-auth] Whay is caldav special?
From: Jeffrey Altman <[email-masked]>
To: [email-masked]
Date: Fri, 30 Sep 2005 15:55:24 -0400
List-Id: ietf-http-auth.osafoundation.org

Eric Rescorla wrote:

> No, I'm just saying that people do that now and we have to
> recognize the reasons why that's done and design a solution
> that transitions as cleanly as possible from that.
> 
> -Ekr

Then let's start a list of the reasons why sites use forms instead
of HTTP AUTH:

* Transmitting all page data over TLS puts too great a load on the
  servers.   Using a form allows just the form submission to be made
  over TLS.  This allows logon forms to be embedded as part of public
  multi-purpose web pages

* Username/Password pairs can be passed along to back end servers so
  that they can be used to obtain additional credential forms that do
  not require additional re-transmission such as Kerberos tickets.

* Using forms avoids the problems associated with HTTP Proxies.  Is
  the authentication meant for the proxy or the destination server?

* Using forms places all of the control in the hands of the web site
  designer.  The choice of web server, its support for HTTP
  authentication, and the APIs to access it can be abstracted out of
  the equation.

Please fill in additional reasons that you are aware of.

Thanks.

Jeffrey Altman