Subject: [http-auth] improving HTTP authentication in user agents

From: Julian Reschke <[email-masked]>
Date: Wed, 13 Mar 2013 13:49:50 +0100

Hi there,

no matter whether we tune/extend existing schemes, or try to deploy new 
schemes, we will have to consider limitations in existing user agents 
with respect to how WWW-Authenticate response header fields are parsed.

See test cases at: <http://greenbytes.de/tech/tc/httpauth/>

*All* of the major browsers get some of these tests wrong (*).

In the case of Firefox, it's because it doesn't have a *parser* for 
WWW-Authenticate; it just does a sub-string lookup.

So, please:

- review test cases,

- contribute new test cases,

- try to get some of the UAs fixed (at least Chromium and FF are Open 
Source...).

Best regards, Julian

(*) Konqueror isn't a "major" browser, but it *does* get things right.

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 13 Mar 2013 18:57:05 +0100

>- contribute new test cases,

Single quotes, unclosed quote marks, \-escapes outside quotes, line
ending with \, case-sensitivity like BASIC, repeated realm parameter
with difference in case, multiple headers, particularily combined with
some of the other ideas, say

  WWW-Authenticate: Basic, realm="foo
  WWW-Authenticate: bar"

extension parameter before 'realm' (oh, you have that already), would
come to mind what does not seem covered by your tests already.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Tim <[email-masked]>
Date: Wed, 13 Mar 2013 11:37:17 -0700

> - contribute new test cases,

What about header continuations? eg:

WWW-Authenticate: Basic
 realm="foo"

Also, I believe I've seen application servers decode things like %22
in quoted header fields before.  I'm guessing this is incorrect
behavior.  So this might be a useful test:

WWW-Authenticate: Basic realm="foo%22"

Not sure how interesting these are, but first that came to mind.
tim

---

From: Julian Reschke <[email-masked]>
Date: Thu, 14 Mar 2013 15:05:07 +0100

> What about header continuations? eg:

Unfortunately, this is something my test setup (httpd with mod_asis) 
won't generate.

That being said: I'm mainly interested in *valid* responses (we should 
achieve interop on valid header fields before even starting to worry 
about invalid ones. (See 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-22.html#rfc.section.3.2.4>).

> WWW-Authenticate: Basic realm="foo%22"

Added as <http://greenbytes.de/tech/tc/httpauth/#simplebasicpct>; 
apparently the browsers are sane with respect to this.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Thu, 14 Mar 2013 16:11:42 +0100

> Single quotes, unclosed quote marks, \-escapes outside quotes, line

Added. Added. Not yet added (concrete proposal?).

> ending with \, case-sensitivity like BASIC, repeated realm parameter

Not yet added. Added.

> with difference in case, multiple headers, particularily combined with

Not sure why that's particularly interesting.

Regarding the remaining proposals: that's something my test framework 
does not support currently (httpd/mod_asis).

Best regards, Julian

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Thu, 14 Mar 2013 16:21:20 +0100

>Added. Added. Not yet added (concrete proposal?).

I was thinking something like realm=\h\e\l\l\o.

>does not support currently (httpd/mod_asis).

http://lists.w3.org/Archives/Public/public-webapps/2010OctDec/0365.html
Did you have any chance to try that yet? I recall testing it back then,
but it's been a while.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Julian Reschke <[email-masked]>
Date: Thu, 14 Mar 2013 16:54:42 +0100

> I was thinking something like realm=\h\e\l\l\o.

OK, added.

> Did you have any chance to try that yet? I recall testing it back then,

I just tried, and that indeed works. I'll look into changing my test 
framework accordingly next week...

Best regards, Julian

---

From: Tim <[email-masked]>
Date: Thu, 14 Mar 2013 13:06:14 -0700

> That being said: I'm mainly interested in *valid* responses (we
> should achieve interop on valid header fields before even starting
> to worry about invalid ones. (See <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-22.html#rfc.section.3.2.4>).

Interesting, I didn't realize this was being deprecated.

> apparently the browsers are sane with respect to this.

Cool, thanks.
tim