Subject: Re: Straw-man charter for http-bis

From: Robert Sayre <[email-masked]>
Date: Mon, 18 Jun 2007 01:14:09 +0000

>
> > Since when do IETF specify client implementation besides what impacts
> > the wire protocols?
> >   
> Traditionally we try to not constrain client design more than necessary,
> but that doesn't mean we strictly limit ourselves to defining what
> happens on the wire.

As several people have mentioned, the extension point we should be 
looking at is the body of the 401 response. All web browsers display 
this content when they don't understand the scheme given in the 
WWW-Authenticate header. That makes it possible to extend HTML with form 
elements specific to secure credentials. That is a wire protocol. The 
meaning and requirements of those elements can probably be made clear 
without venturing very far into client design.

- Rob

---

From: Henrik Nordstrom <[email-masked]>
Date: Tue, 19 Jun 2007 02:12:04 +0200

mån 2007-06-18 klockan 01:14 +0000 skrev Robert Sayre:

> That makes it possible to extend HTML with form 

Yes, and is what has been proposed several times, in several threads on
the topic.. but no detailed proposal written down yet.

I would very much welcome a proposal from some browser vendor on this.
It's mainly browser technology which needs updates to adopt a feature
like this, on the server side it's most often just reconfiguration or at
worst trivial changes depending on the fine details of the proposed
extension and nature of the server implementation of 401 responses.

Regards
Henrik