Subject: RFC 2617 Authentication-Info BNF

From: Tim Olsen <[email-masked]>
Date: Mon, 1 Oct 2007 15:47:02 -0400

Hello,

I am a little confused about the augmented BNF for Authentication-Info
in RFC 2617 3.2.3.

The part of the ABNF I am confused about is:

        AuthenticationInfo = "Authentication-Info" ":" auth-info
        auth-info          = 1#(nextnonce | [ message-qop ]
                               | [ response-auth ] | [ cnonce ]
                               | [nonce-count] )

Does this ABNF mean that nextnonce is required in auth-info?  If so, why
is there the sentence, "If the nextnonce field is present the client
SHOULD use it when constructing the Authorization header for its next
request." ? That would seem to imply that nextnonce is optional.  Later
on, the RFC also states "pipelined requests will not be possible if
every response includes a nextnonce directive that must be used on the
next request received by the server."

Searching the archives show that this issue was brought up over a year
ago, but there was no response
(http://lists.w3.org/Archives/Public/ietf-http-wg/2006AprJun/0031.html).
Any feedback would be appreciated.

Thanks!

-Tim

---

From: Paul Leach <[email-masked]>
Date: Mon, 1 Oct 2007 17:24:10 -0700

The "nextnonce" is optional. To see why, ask yourself if
        Authentication-Info rspauth="ab10f00baa"
is legal according to the ABNF. Hint -- what does "1#" mean?

---

From: Tim Olsen <[email-masked]>
Date: Tue, 2 Oct 2007 11:36:35 -0400

On Mon, 1 Oct 2007 17:24:10 -0700

> is legal according to the ABNF. Hint -- what does "1#" mean?

ok, I understand that technically.  But what is the purpose of having
square brackets around the other directives, but not around nextnonce? 

>                                | [ response-auth ] | [ cnonce ]

Thanks,
Tim

---

From: Paul Leach <[email-masked]>
Date: Tue, 2 Oct 2007 09:19:40 -0700

-----Original Message-----
From: Tim Olsen [mailto:[email-masked]]

ok, I understand that technically.  But what is the purpose of having
square brackets around the other directives, but not around nextnonce?
[Paul Leach] I don't know. It may have just been an oversight.