Subject: Re: I-D Action:draft-nottingham-http-portal-01.txt

From: Thomas Broyer <[email-masked]>
Date: Fri, 1 Oct 2010 17:50:58 +0200

On Thu, Aug 19, 2010 at 7:24 AM, Mark Nottingham <[email-masked]> wrote:
> FYI: now includes concrete protocol elements, etc.
>
> Begin forwarded message:
>
>> From: [email-masked]
>> Date: 18 August 2010 2:00:03 PM AEST
>> To: [email-masked]
>> Subject: I-D Action:draft-nottingham-http-portal-01.txt
>> Reply-To: [email-masked]
>>
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>>
>>       Title           : The Network Authentication Required HTTP Status Code
>>       Author(s)       : M. Nottingham
>>       Filename        : draft-nottingham-http-portal-01.txt
>>       Pages           : 7
>>       Date            : 2010-08-17
>>
>> "Captive portals" are a commonly-deployed means of obtaining access
>> credentials and/or payment for a network.  This memo introduces a new
>> HTTP status code as a means of addressing issues found in these
>> deployments.
>>
>> This memo should be discussed on the [email-masked] mailing
>> list, although it is not a work item of the HTTPbis WG.
>>
>> A URL for this Internet-Draft is:
>> http://www.ietf.org/internet-drafts/draft-nottingham-http-portal-01.txt

Seeing the example, it looks like my previous idea [1] of defining a
new "308 Unauthorized, See other" status code would be better served
with a Refresh header (or HTML meta) in the
401+WWW-Authenticate:Cookie response (given that it'd be required
anyway, as only Safari honors the redirect).

(and it looks like it was my conclusion at that time... [2] I don't
know why I pursued the idea a few months later! [3])

Is the Refresh header field defined somewhere? (the meta refresh is
defined in HTML, including HTML5 [4], but how about the HTTP header?
–that might have been the reason I kept the 308 around)

[1] http://www.w3.org/mid/[email-masked]
[2] http://www.w3.org/mid/[email-masked]
[3] http://hg.ltgt.net/http-cookie-auth/rev/d786cfe607a4
[4] http://www.w3.org/TR/html5/semantics.html#attr-meta-http-equiv-refresh

-- 
Thomas Broyer
/tɔ.ma.bʁwa.je/

---

From: Julian Reschke <[email-masked]>
Date: Sat, 02 Oct 2010 09:33:22 +0200

On 01.10.2010 17:50, Thomas Broyer wrote:
> ...
> ...

I don't think it has a proper spec, no is it registered.

That being said, I checked when I saw the example in Mark's proposal. As 
far as I recall, the header "works" in all UAs I tested with the 
exception of Konqueror.

So maybe it's time to actually specify it properly.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Sat, 02 Oct 2010 11:58:07 +0200

On 02.10.2010 11:49, Thomas Broyer wrote:
> In HTTPbis or another spec?
>
> (fortunately, most of the spec could be extracted/copied from HTML5,
> with the editor's and/or WGs permission)

I think a separate spec would be good.

Adopting some of the text from HTML5 would work, but I would 
definitively define the syntax per ABNF.

The tricky part is to decide whether this is just a specification of 
something that is already there, or whether it should be deprecated (in 
favor of 3xx/location?).

Best regards, Julian

---

From: Thomas Broyer <[email-masked]>
Date: Sat, 2 Oct 2010 11:49:13 +0200

On Sat, Oct 2, 2010 at 9:33 AM, Julian Reschke <[email-masked]> wrote:
> That being said, I checked when I saw the example in Mark's proposal. As far
> as I recall, the header "works" in all UAs I tested with the exception of
> Konqueror.
>

-- 
Thomas Broyer
/tɔ.ma.bʁwa.je/

---

From: Mark Nottingham <[email-masked]>
Date: Sun, 3 Oct 2010 11:52:05 +1100

I've started tracking this sort of thing on the WG wiki:
  http://trac.tools.ietf.org/wg/httpbis/trac/wiki/PotentialWork

Cheers,

On 02/10/2010, at 7:58 PM, Julian Reschke wrote:

> Adopting some of the text from HTML5 would work, but I would definitively define the syntax per ABNF.
> 
> The tricky part is to decide whether this is just a specification of something that is already there, or whether it should be deprecated (in favor of 3xx/location?).
> 
> Best regards, Julian
> 

--
Mark Nottingham   http://www.mnot.net/