Subject: [http-auth] draft-farrell-httpbis-hoba feedback

From: Julian Reschke <[email-masked]>
Date: Tue, 23 Apr 2013 12:43:59 +0200

Hi there,

below a few comments wrt to the base HTTP spec.

Editorial: the "b64token" ABNF production is now "token68".

Furthermore:

"The "token68" notation was introduced for compatibility with existing 
authentication schemes and can only be used once per 
challenge/credentials. New schemes thus ought to use the "auth-param" 
syntax instead, because otherwise future extensions will be impossible." 
-- 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-auth-22.html#considerations.for.new.authentication.schemes>

...so why is HOBA using it?

Best regards, Julian

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 23 Apr 2013 11:51:13 +0100

Hiya,

> Editorial: the "b64token" ABNF production is now "token68".

Thanks.

> syntax instead, because otherwise future extensions will be impossible."

Gotta admit I don't get that fully, but fwiw our definite intent
is to be a good citizen here. Is there somewhere we're misusing
the auth-param thing in the current version?

Ta,
S.

---

From: Julian Reschke <[email-masked]>
Date: Tue, 23 Apr 2013 13:32:46 +0200

On 2013-04-23 12:51, Stephen Farrell wrote:
> ...

Currently it says:

    When the "client response" is created, the HOBA-http client encodes
    the result as a b64token and returns that b64token in the
    Authorization header.

So this uses the same format as Basic (which is discouraged):

   Authorization: 12345678

What it *should* use is an auth-param, so something like

   Authorization: response="12345678"

Best regards, Julian

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 23 Apr 2013 14:08:58 +0100

>   Authorization: response="12345678"

Ah gotcha, will do that when we re-spin,

Thanks,
S.