Subject: [http-auth] Stephen Farrell's Yes on draft-ietf-httpauth-extension-08: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Thu, 01 Sep 2016 06:34:11 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-httpauth-extension-08: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-extension/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I think experiments to improve web authentication are a good
thing (tm:-) so am happy to see this experiment proceed.

- Figure 1: Maybe clarify that "credentials" here is not the
same as in RFC 7235?

- Figure 3: this is a mixture of an example ("Basic") and ABNF
("1#challenge") which is odd. I'd say just make it an example
and fix the figure caption accordingly.

- section 7: I thought that registrations of new HTTP headers
needed some more information, e.g. in which messages they can
be sent and with which status codes? BCP90 does seem to call
for that - why aren't those details here?

---

From: 大岩寛 <[email-masked]>
Date: Sat, 3 Sep 2016 03:45:30 +0000

Thank you very much for the comments.
 
> I think experiments to improve web authentication are a good thing (tm:-) so
> am happy to see this experiment proceed.
> 
> - Figure 1: Maybe clarify that "credentials" here is not the same as in RFC
> 7235?

That's correct.

> ("1#challenge") which is odd. I'd say just make it an example and fix the figure
> caption accordingly.
> 
> - section 7: I thought that registrations of new HTTP headers needed some more
> information, e.g. in which messages they can be sent and with which status
> codes? BCP90 does seem to call for that - why aren't those details here?

We'll reflects these into the next draft. Thank you.

-- 
Yutaka OIWA, Ph.D.       Leader, Cyber Physical Architecture Research Group
                                  Information Technology Research Institute
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]