Subject: [http-auth] I-D Action: draft-ietf-httpauth-basicauth-update-01.txt

From: [email-masked]
Date: Fri, 04 Jul 2014 08:26:06 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Hypertext Transfer Protocol Authentication Working Group of the IETF.

        Title           : The 'Basic' HTTP Authentication Scheme
        Author          : Julian F. Reschke
	Filename        : draft-ietf-httpauth-basicauth-update-01.txt
	Pages           : 13
	Date            : 2014-07-04

Abstract:
   This document defines the "Basic" Hypertext Transfer Protocol (HTTP)
   Authentication Scheme, which transmits credentials as userid/password
   pairs, obfuscated by the use of Base64 encoding.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-basicauth-update/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-httpauth-basicauth-update-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-httpauth-basicauth-update-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Yoav Nir <[email-masked]>
Date: Fri, 4 Jul 2014 19:36:37 +0300

Thanks you, Julian!

Group: we’ll be discussing this draft at the Toronto meeting (Thursday morning, 24-Jul).  Please read it and send comments to the list.

Yoav

On Jul 4, 2014, at 6:26 PM, [email-masked] wrote:

> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

---

From: Julian Reschke <[email-masked]>
Date: Mon, 07 Jul 2014 14:44:17 +0200

On 2014-07-04 18:36, Yoav Nir wrote:
> ...

Indeed. It's late, and I'm sorry about that.

So this has been put together in a kind of a hurry, so I totally expect 
that some more editorial work is needed (both with respect to structure 
and language).

Other than that please look for:

- security considerations - these are more or less the same as in RFC 
2617, and if people want to improve those please go ahead, after all, 
this is the Security area (but keep in mind to focus on considerations 
*specific* to the Basic scheme).

- we have some implementation specific stuff we may want to discuss in a 
new section (handling of ":" in user-id, NFC, ...)

- the part about when credentials can be re-used and sent proactively 
needs to be rephrased (with respect to hierarchy in HTTP URLs, *and* tested)

Best regards, Julian