Subject: [http-auth] Commands on draft-ietf-httpauth-extension-00

From: Michael Sweet <[email-masked]>
Date: Tue, 02 Jul 2013 08:18:49 -0400

All,

Some quick comments on draft-ietf-httpauth-extension-00:

- Section 3: Maybe include an example of a POST request with an Expect: 100-continue header, with the 100 response including the Optional-WWW-Authenticate response? This will have some interesting applications for printing/IPP. I'm also interested to see how a Client "aborts" the current POST/PUT request and re-submits with an Authorization header - sending an empty message body might be applicable for a POST, depending on the situation, but an empty PUT might has unpleasant side-effects. Closing the connection before sending the message body might be a clearer/cleaner signal to the Server, but seems a bit heavy-handed...

- Section 4: Any reason to not allow multiple challenges here, a la 2616's WWW-Authenticate header?

- Section 4.5: What about a logout-timeout value that indicates that credentials are discarded after the web browser session is closed/quit? HTTP cookies have this capability and is used on a regular basis. This is still independent of whether the browser/system caches usernames and passwords, it just forces user interaction at the beginning of a new session...

Longer term I'd actually like to see something like this made mandatory for HTTP/2.0 since that is what will be needed to convince many to switch away from cookie-based approaches.

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair