Subject: Re: #309: credentials ABNF missing SP (still using implied LWS?)

From: Julian Reschke <[email-masked]>
Date: Fri, 05 Aug 2011 17:45:09 +0200

On 2011-07-27 19:43, Julian Reschke wrote:
> Hi,
>
> James Manger found this earlier, and I just rediscovered that we have an
> inconsistency between challenge and credentials. Right now we have:
>
> credentials = auth-scheme ( token
> / quoted-string / #auth-param )
>
> ...which doesn't allow white space between the scheme name and the
> credentials.
>
> Going back in history, RFC 2617 has:
>
> challenge = auth-scheme 1*SP 1#auth-param
>
> and
>
> credentials = auth-scheme #auth-param
>
> (which depends on implied LWS).
>
> Does /anybody/ remember why RFC 2617 treats these differently? Was this
> intentional?

Didn't get any feedback.

However,

   credentials = auth-scheme #auth-param

in particular would allow something like

   Authorization: SchemenameParam=1

which of course doesn't make sense.

So I'm adding the mandatory whitespace...

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Fri, 05 Aug 2011 17:55:06 +0200

> So I'm adding the mandatory whitespace...

Done with <http://trac.tools.ietf.org/wg/httpbis/trac/changeset/1378>.

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 05 Aug 2011 11:58:09 -0400

>> So I'm adding the mandatory whitespace...
Yes, this make sense.