Subject: [http-auth] Ben Campbell's Yes on draft-ietf-httpauth-digest-18: (with COMMENT)

From: "Ben Campbell" <[email-masked]>
Date: Tue, 21 Apr 2015 14:28:03 -0700

Ben Campbell has entered the following ballot position for
draft-ietf-httpauth-digest-18: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Just a few minor comments:

3.3, domain: "If the URI is an abs_path..."

Should that be "path-absolute", in keeping with the reference to 3986?

3.6, paragraph 4: "Because the client is REQUIRED to return..."

The use of a 2119 keyword in a dependent clause seems odd.

5.1:  "Digest authentication SHOULD be used over a secure channel like
HTTPS"

Does this mean that, if you have a secure channel you should use digest,
or if you use digest you should use a a secure channel? I assume the
second, but the sentence can be parsed either way.

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 22 Apr 2015 17:10:06 -0400

Hi Ben,

Thanks for your review and comments.
I will address these in the next version of the draft.

Regards,
 Rifaat