Subject: Re: RFC2616 vs RFC2617, was: Straw-man charter for http-bis

From: Alexey Melnikov <[email-masked]>
Date: Mon, 02 Jul 2007 12:22:18 +0100

Henrik Nordstrom wrote:

>tor 2007-06-07 klockan 18:18 +0200 skrev Julian Reschke:
>  
>
>>BTW: does the framework really require fixing?
>>    
>>
>Not really imho. It's an extensible negotiable framework for message
>based authentication with no dependencies on how such authentication is
>implemented besides it being message based to fit in the message
>structure of HTTP.
>  
>
I don't think that the framework itself is broken. But one thing that 
needs to clarified is that authentication exchange using a new 
authentication mechanism X can use more than 1 roundtrip and use the 
same HTTP header for each authentication step. Many existing 
implementations are designed to expect data from the second round trip 
in another header (like in Digest).

---

From: Henrik Nordstrom <[email-masked]>
Date: Mon, 02 Jul 2007 15:57:24 +0200

> in another header (like in Digest).

My view on this:

WWW-Authenticate is fine for 401. For additional information after
successful (or failed) authentication and useful to verify the server
identity or provide information to be used on the next authenticated
request or other information about the outcome of the authentication
request Authentication-Info is more suited, and it's presence should be
declared as part of the framework and not just a by-product of Digest..

The format of Authentication-Info response header should be scheme
specific, defined by the scheme used in the Authorization request
header.

Regards
Henrik

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 02 Jul 2007 15:05:59 +0100

>declared as part of the framework and not just a by-product of Digest..
Indeed, this is one way to clarify the framework.