Subject: opaque parameter in the Authorization request header

From: Evgeniy Khramtsov <[email-masked]>
Date: Wed, 13 Aug 2008 18:57:41 +1000

Hello!

I have a question regarding RFC 2617 (HTTP Authentication). Please, 
forgive me if it is not the right list for such questions.
In RFC 2617 para 3.2.2 it is saying that: "The values of the opaque and 
algorithm fields must be those supplied in the WWW-Authenticate response 
header for the entity being requested". Does it mean that "opaque" field 
is mandatory in the "Authorization" header in the case it was present in 
the "WWW-Authenticate" header?

Currently I'm a spectator of a situation when a client doesn't include 
an "opaque" field in the "Authorization" header and a server replies 
with 400 "Authorization should contain opaque". Actually, I don't know 
who is right: a client or a server?

Thanks!

-- 
Regards,
Evgeniy Khramtsov, ProcessOne.
xmpp:[email-masked].

---

From: Henrik Nordstrom <[email-masked]>
Date: Wed, 13 Aug 2008 12:15:56 +0200

> who is right: a client or a server?

The way I read it the server is right.

The language isn't fully formal, but it does say should (3.2.1) and
required (3.3), which means a client not returning the opaque is clearly
broken.

And with opaque included in the earlier RFC2069 specifications with
nearly the same language there really is no excuse for not returning
it..

Regards
Henrik

---

From: "Frank Ellermann" <[email-masked]>
Date: Wed, 13 Aug 2008 20:41:28 +0200

Henrik Nordstrom wrote:

> there really is no excuse for not returning it

+1

I've no idea why RFC 2069 settled for a "should"
instead of a "must" here.  It could mean that
servers aren't forced to insist on its presence,
but if they insist on it they are not violating
the spec.  

 Frank