Subject: Comments on draft-oiwa-httpbis-auth-extension-00

From: Alexey Melnikov <[email-masked]>
Date: Sun, 10 Jun 2012 18:21:54 +0100

In general I think this is a useful document and it is worth working on in the WG. Below are my general comments (I would have nitpicked a bit more if this document was in IETF LC).

Optional authentication: is a new header field really needed or can this be already done using a 200 response containing a WWW-Authenticate header field? Was use of 200 with WWW-Authenticate tried and it didn't work with existing browsers?

Section 3, last paragraph: some MAYs in the last couple of sentences look incorrect. I also think that making some HTTP authentication schemes require this header field would be a mistake, at least before HTTP authentication framework is updated to include the new header field.

Similar text in Section 4, 2nd paragraph. The same problem.

In 4.3, 2nd to the last paragraph, last sentence: I think you need to specify which one wins (or to ignore the whole header field), otherwise this is not very useful.

In 4.3, last paragraph: avoid passive voice. Otherwise it is not clear whom the SHOULD/SHOULD NOT applies to. Also the use of SHOULD doesn't seem to be correct, but I can't tell until you clarify whom it applies to.

 In 4.2 and 4.4: the pattern "MUST be an absolute URI, MAY be treated as relative if not" seems a bit wrong. Either use of absolute URIs is optional (and then you must use SHOULD/MAY), or it is not and the MAY needs to be dropped. Either way, use of MAY is incorrect here.

In 4.4: I think you meant "authentication sessions" instead of "authentication period"

Is auth-style value correct in Section 5.2?

Best Regards,
Alexey

---

From: Yutaka OIWA <[email-masked]>
Date: Thu, 14 Jun 2012 10:51:21 +0900

Dear Alexey,

Thank you very much.
Your comments are really valuable for me to improve the draft.

I'd like to answer immediately for the comment on optional
authentication design:

> Optional authentication: is a new header field really needed or can this be already done using a 200 response containing a WWW-Authenticate header field? Was use of 200 with WWW-Authenticate tried…

As far as I know,

 * Until recently, validity for the use of WWW-Authenticate header in
200-response
    was unclear.  It was clarified in the discussion of httpbis and it
is now OK.
    (I designed the protocol before that.)

 * My design principle is that, clients not supporting optional authentication
    should ignore the request, so that Web site programmers can implement
    their own fallback mechanisms.

 * Someone in httpbis ML has checked for behavior of various browsers,
   and it will work (ignored) for all except one browser (forcibly
authenticate),
   I remember.

 * I want some consensus whether we can ignore this one case for the future,
   or we have to be conservative on that.

 * I like both approaches, so if people think the alternative is better,
   I'd like to migrate it.

 * We need some additional rules for making optional authentication
   with 200-status work (such as how the server will tell client about
   success/failure status of the authentication).
   I will research it and update the draft once the direction is decided.

-- 
Yutaka OIWA, Ph.D.              Leader, Software Reliability Research Group
                             Research Institute for Secure Systems (RISEC)
   National Institute of Advanced Industrial Science and Technology (AIST)
                     Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]