Subject: [http-auth] Question regarding RFC 7617

From: Enrico Bonato <[email-masked]>
Date: Wed, 7 Mar 2018 11:01:54 +0000

Greetings
the proposed standard in the Subject marks usernames containing ":" as invalid. 
Quoting section 2:

"Furthermore, a user-id containing a colon character is invalid, as
   the first colon in a user-pass string separates user-id and password
   from one another"

This is totally understandable, but limits interoperability with systems (e.g. LDAP's DNs - rfc2253) which allows such character.

What if a username contains (one or more) colon characters already? Shouldn't this character be escapable as "special" character? 

Best regards
Enrico Bonato

---

From: Julian Reschke <[email-masked]>
Date: Wed, 7 Mar 2018 21:08:39 +0100

On 2018-03-07 12:01, Enrico Bonato wrote:
> ...

Yes, it should have been. But this wasn't considered when Basic auth was 
defined initially, and there was no simply way to retrofit this into the 
protocol many years later...

Best regards, Julian