Subject: [http-auth] Comments on draft-ietf-httpauth-mutual-00

From: Michael Sweet <[email-masked]>
Date: Tue, 02 Jul 2013 08:50:04 -0400

All,

Some quick comments on draft-ietf-httpauth-mutual-00:

- Section 2.2: The example shows the server returning an Authentication-Info header with an "auth-scheme 1#auth-param" format, but RFC 2617 doesn't define it that way; see my comments on the SCRAM draft.

- Section 3: Is the SHALL for the Authentication-Info header appropriate here? Seems like  it would be better to reference the subsection defining the header and let it state any conformance requirements.

- Section 4.1: Again, SHALL seems wrong here (as does "noticed").  Maybe:

  Every 401-INIT or 401-STALE message is a valid HTTP 401-status (Authentication Required) message that MUST contain a single "WWW-Authenticate" header containing a "reason" parameter in the challenge.

- I don't see a (re)definition of the Authorization, Authentication-Info, or WWW-Authenticate headers in this document. Traditionally such sections are included with an ABNF fragment and any conformance requirements to make things explicit for implementors.

- The examples all focus on GET requests.  What about POST, PUT, and Expect: 100-continue? These are all important for form submissions and layered protocols like SOAP and IPP... (particularly IPP - need a way to avoid re-sending gigabytes of print data...)

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair