Subject: WWW-Authenticate ABNF is ambiguous

From: Julian Reschke <[email-masked]>
Date: Sat, 06 Aug 2011 21:06:55 +0200

Hi,

so the ABNF is:

WWW-Authenticate = *( "," OWS ) challenge *( OWS "," [ OWS challenge ] )
challenge = auth-scheme 1*SP *( "," OWS ) auth-param *( OWS "," [ OWS
  auth-param ] )

Example:

   Basic realm="foo", , Otherscheme realm="bar"

This can be parsed as either three challenges:

1: Basic realm="foo"
2:
3: Otherscheme realm="bar"

or as two challenges:

1: Basic realm="foo",
2: Otherscheme realm="bar"

...where the first challenge has a list of auth-params where the first 
one is the realm, and the second one is empty.

In practice, this doesn't affect the semantics of the header field, but 
it *does* affect parser construction.

Best regards, Julian

(writing this down and sending it to the list because I just wasted a 
lot of time trying to find a problem somewhere else)