Subject: [http-auth] draft-ietf-httpauth-digest-01: realm missing quotes

From: Brett Tate <[email-masked]>
Date: Mon, 13 Jan 2014 11:53:59 +0000

Hi,

Concerning draft-ietf-httpauth-digest-01 section 3.4.5 example, the realm value should be within quotes: realm="[email-masked]".

Thanks,
Brett

This email is intended solely for the person or entity to which it is addressed and may contain confidential and/or privileged information. If you are not the intended recipient and have received this email in error, please notify BroadSoft, Inc. immediately by replying to this message, and destroy all copies of this message, along with any attachment, prior to reading, distributing or copying it.

---

From: Julian Reschke <[email-masked]>
Date: Mon, 13 Jan 2014 14:13:54 +0100

> Concerning draft-ietf-httpauth-digest-01 section 3.4.5 example, the realm value should be within quotes: realm="[email-masked]".

Nope.

First of all, the Digest spec shouldn't try to have an ABNF for the 
"Digest" challenge *at all*. The format for that header field is defined 
in 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-auth-25.html#rfc.section.2.1>:

   auth-scheme    = token

   auth-param     = token BWS "=" BWS ( token / quoted-string )

   token68        = 1*( ALPHA / DIGIT /
                        "-" / "." / "_" / "~" / "+" / "/" ) *"="

   challenge   = auth-scheme [ 1*SP ( token68 / #auth-param ) ]

What the spec should define is the set of defined auth-params. The 
generic ABNF allows both "token" and "quoted-string" values, and this 
should be the default for all new parameters. For existing parameters, 
when it is known that certain syntax variants are not (yet?) 
interoperable, it should just state that in prose.

Best regards, Julian

---

From: Brett Tate <[email-masked]>
Date: Mon, 13 Jan 2014 14:02:46 +0000

> > Concerning draft-ietf-httpauth-digest-01 section 
> > 3.4.5 example, the realm value should be within 
> > quotes: realm="[email-masked]".
> 
> Nope.
> 
> First of all, the Digest spec shouldn't try to have 
> an ABNF for the "Digest" challenge *at all*. 

My comment was based upon the ABNF within draft-ietf-httpauth-digest-01 section 1.

   realm       = "realm" "=" realm-value
   realm-value = quoted-string

If the ABNF changes and there is no reason to show the example as backward compatible with RFC 2617 (Errata ID 3720 reported same issue), then I agree that the example does not need modification.

Thanks,
Brett

---

From: Julian Reschke <[email-masked]>
Date: Mon, 13 Jan 2014 15:22:03 +0100

> If the ABNF changes and there is no reason to show the example as backward compatible with RFC 2617 (Errata ID 3720 reported same issue), then I agree that the example does not need modification.

The ABNF needs to change; any update to RFC 2617 needs to conform to the 
requirements in 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-auth-25.html#considerations.for.new.authentication.schemes>.

Best regards, Julian

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 13 Jan 2014 09:33:11 -0500

Thanks Julian,

The ABNF in the draft was copied from RFC2617. I will fix it in the next
version of the draft.

Regards,
 Rifaat

On Mon, Jan 13, 2014 at 9:22 AM, Julian Reschke <[email-masked]>wrote:

>> If the ABNF changes and there is no reason to show the example as
>> backward compatible with RFC 2617 (Errata ID 3720 reported same issue),
>> then I agree that the example does not need modification.
>>
>
> requirements in <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-
> auth-25.html#considerations.for.new.authentication.schemes>.
>
> Best regards, Julian
>
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Brett Tate <[email-masked]>
Date: Mon, 13 Jan 2014 14:41:31 +0000

> <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-auth-
> 25.html#considerations.for.new.authentication.schemes>.

Based upon draft-ietf-httpbis-p7-auth-25 section 2.2 Protection Space (Realm), the example does not appear compliant to the following MUST.

"For historical reasons, a sender MUST only generate the quoted-string syntax."

Thanks,
Brett