Subject: [http-auth] Last Call review: Basic Authentication Scheme

From: Michael Köller <[email-masked]>
Date: Mon, 22 Dec 2014 14:47:35 +0100

Hi,

Today Julian asked me to review the Basic authentication Last Call draft.
Apologies if my remarks may already have been discussed on this list. I just subscribed today for the purpose of this mail, so I’m most probably not up to date with current discussion not yet reflected in the document.

There’s one sentence that might qualify as a bug? Chapter 2.2 defines the term ‚authentication scope‘. It reads:
> Given the absolute URI ([RFC3986], Section 4.3) of an authenticated request, the authentication scope of that request is obtained by removing all characters after the last slash ("/") character.
I assume this definition fails to address slashes within the query part of the URI. So the authorization scope should be obtained by removing all characters after the last slash in the path of the absolute request URI.

Regards,
Michael

---

From: Julian Reschke <[email-masked]>
Date: Wed, 24 Dec 2014 13:52:33 +0100

On 2014-12-22 14:47, Michael Köller wrote:
>  ...

Good catch, Michael.

How about:

>    Given the absolute URI ([RFC3986], Section 4.3) of an authenticated
>    request, the authentication scope of that request is obtained by
>    removing all characters after the last slash ("/") character of the
>    path component ("hier_part", see [RFC3986], Section 3).  A client
>    SHOULD assume that resources identified by URIs with a prefix-match
>    of the authentication scope are also within the protection space
>    specified by the realm value of the that authenticated request.

Best regards, Julian