Subject: [http-auth] I-D Action: draft-ietf-httpauth-basicauth-enc-03.txt

From: [email-masked]
Date: Tue, 04 Mar 2014 02:06:13 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

        Title           : An Encoding Parameter for HTTP Basic Authentication
        Author          : Julian F. Reschke
	Filename        : draft-ietf-httpauth-basicauth-enc-03.txt
	Pages           : 11
	Date            : 2014-03-04

Abstract:
   The "Basic" authentication scheme defined in RFC 2617 does not
   properly define how to treat non-ASCII characters.  This has led to a
   situation where user agent implementations disagree, and servers make
   different assumptions based on the locales they are running in.
   There is little interoperability for the non-ASCII characters in the
   ISO-8859-1 character repertoire, and even less interoperability for
   any characters beyond that.

   This document defines a backwards-compatible extension to "Basic",
   specifying the server's character encoding scheme expectation, using
   a new authentication scheme parameter.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-basicauth-enc/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-basicauth-enc-03

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-basicauth-enc-03

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Julian Reschke <[email-masked]>
Date: Tue, 04 Mar 2014 11:28:30 +0100

On 2014-03-04 11:06, [email-masked] wrote:
> ...

This updates the Basic encoding extension spec (*) to state that we want 
NFC:

    The only allowed value is "UTF-8", to be matched case-insensitively
    (see [RFC2978], Section 2.3).  It indicates that the server expects
    user name and password to be converted to Unicode Normalization Form
    C ("NFC", see Section 3 of [RFC5198]) and to be encoded into octets
    using the UTF-8 character encoding scheme ([RFC3629]).

See also: 
<http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-basicauth-enc-03>

We also discussed further normalization during the WG meeting, and my 
understanding is that the rough consensus in the room was not to attempt 
this for now.

Best regards, Julian

(*) Yes, still to be integrated into the Basic auth spec replacement.