Subject: [http-auth] Revising the "Basic" parts of RFC 2617

From: Julian Reschke <[email-masked]>
Date: Wed, 13 Mar 2013 16:03:37 +0100

Hi there,

the above is in our charter, and I totally support that goal.

Apart from extracting the text into a standalone document that 
references HTTPbis-Part7, the following things should be done:

1) Rephrase the security considerations (for instance, with respect to 
"Basic" over https).

2) *Explain* the I18N issue.

3) Update references where needed.

4) Resolve errata (the one I'm aware of -- 
<http://www.rfc-editor.org/errata_search.php?rfc=2617&eid=1959> -- will 
be gone once we update the document to reference HTTPbis).

The charter also asks for

5) *fixing* the I18N issue.

That's non-trivial; see 
<http://greenbytes.de/tech/webdav/draft-reschke-basicauth-enc-07.html#faq>. 
That draft has a *proposal* for fixing the issue, but it's 
unimplemented. I do not believe we can claim it solves the I18N issue 
unless we can show that it works in practice (two servers, to UAs).

As such I would propose to:

a) Just do 1)..4)

b) Publish something like 
<http://greenbytes.de/tech/webdav/draft-reschke-basicauth-enc-07.html> 
as Experimental

c) Revisit the issue once we see implementations of b)

Best regards, Julian

---

From: Nico Williams <[email-masked]>
Date: Wed, 13 Mar 2013 17:34:01 -0500

On Wed, Mar 13, 2013 at 10:03 AM, Julian Reschke <[email-masked]> wrote:
> That draft has a *proposal* for fixing the issue, but it's unimplemented. I
> do not believe we can claim it solves the I18N issue unless we can show that
> it works in practice (two servers, to UAs).
>
> <http://greenbytes.de/tech/webdav/draft-reschke-basicauth-enc-07.html> as
> Experimental

IU support this, though I wouldn't stop at Experimental.  This one
seems safe enough to go straight to the Standards Track.

Nico
--

---

From: Julian Reschke <[email-masked]>
Date: Thu, 14 Mar 2013 16:58:36 +0100

On 2013-03-13 16:03, Julian Reschke wrote:
> ...

While looking at my test cases, I remembered that there's also a I18N 
issue with respect to the "realm" parameter. My tests show that UAs 
currently treat it as ISO-8859-1.

Not sure whether this *needs* to be addressed, nor how exactly. As an 
internal key, ASCII should be enough. For display purposes, we could add 
a "realm-title" or "prompt" parameter with proper I18N.

Best regards, Julian

---

From: Yutaka OIWA <[email-masked]>
Date: Fri, 15 Mar 2013 03:35:02 +0900

Dear Julian,

2013/3/15 Julian Reschke <[email-masked]>:

> While looking at my test cases, I remembered that there's also a I18N issue
> with respect to the "realm" parameter. My tests show that UAs currently
> treat it as ISO-8859-1.

Have you tested also with non-Latin-1-native environments?
As far as I can test, IE9 in Japanese MS Windows parse
the realm parameter with traditional locale charset (that is Shift_JIS).
There are still some Websites and embedded systems
which make use of Japanese realms in Shift_JIS encoding.
# I guess this is why IE9 is still doing this tradition-origined behavior.

Of course, I will NEVER say that this is the correct behavior.
It is just an observation.

Firefox 19 (Japanese localisation on Japanese MS Windows)
seems to be parsing it in ISO-8859-1.
I don't remember from which version FF honors this behavior.

-- 
Yutaka OIWA, Ph.D.              Leader, Software Reliability Research Group
                             Research Institute for Secure Systems (RISEC)
   National Institute of Advanced Industrial Science and Technology (AIST)
                     Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

---

From: Julian Reschke <[email-masked]>
Date: Thu, 14 Mar 2013 19:45:31 +0100

> Have you tested also with non-Latin-1-native environments?

Nope.

> the realm parameter with traditional locale charset (that is Shift_JIS).

Can you try 
<http://greenbytes.de/tech/tc/httpauth/#simplebasicrealmiso88591>?

Best regards, Julian

---

From: Yutaka OIWA <[email-masked]>
Date: Fri, 15 Mar 2013 04:40:24 +0900

> <http://greenbytes.de/tech/tc/httpauth/#simplebasicrealmiso88591>?

Yes.

http://www.oiwa.jp/~yutaka/temp/simplebasicrealmiso88591-ie9jp.png
http://www.oiwa.jp/~yutaka/temp/simplebasicrealmiso88591-ff19jp.png

IE9 shows the realm as "foo-<middle-dot>", where the dot is actually
a placeholder for unparsible multi-byte character.

Another one with UTF-8 example,

http://www.oiwa.jp/~yutaka/temp/simplebasicrealmutf8-ie9jp.png

shows "foo-<halfwidth-katakana-letter-te><halfwidth-ideographic-comma>",
where two half-width characters corresponds to C3 A4.