Subject: p7: forwarding Proxy-*

From: Mark Nottingham <[email-masked]>
Date: Tue, 30 Apr 2013 11:38:57 +1000

(editorial) 

p7 4.2 says:
 
> Unlike WWW-Authenticate, the Proxy-Authenticate header field applies only to the current connection, and intermediaries should not forward it to downstream clients. However, an intermediate proxy might need to obtain its own credentials by requesting them from the downstream client, which in some circumstances will appear as if the proxy is forwarding the Proxy-Authenticate header field.

and 4.3 says:

> Unlike Authorization, the Proxy-Authorization header field applies only to the next outbound proxy that demanded authentication using the Proxy-Authenticate field. When multiple proxies are used in a chain, the Proxy-Authorization header field is consumed by the first outbound proxy that was expecting to receive credentials. A proxy may relay the credentials from the client request to the next proxy if that is the mechanism by which the proxies cooperatively authenticate a given request.

However, neither says that the header needs to be listed in the Connection header; i.e. that it's hop-by-hop, as per RFC2616 13.5.1. If you recall, we removed the explicit list of hop-by-hop headers, opting to say that they needed to be listed in Connection, because doing so was causing confusion. However, we haven't actually specified that for these two headers.

Recommend language like this:

"""
Unlike WWW-Authenticate, the Proxy-Authenticate header field applies only to the current connection, and thus MUST be listed in the Connection header field [ref], so that it is consumed on the next hop. Note that an intermediate proxy might need to obtain its own credentials by requesting them from the downstream client, which in some circumstances will appear as if the proxy is forwarding the Proxy-Authenticate header field.
"""

--
Mark Nottingham   http://www.mnot.net/

---

From: "Roy T. Fielding" <[email-masked]>
Date: Mon, 29 Apr 2013 18:59:42 -0700

That would be incorrect (and is not editorial).  The Proxy-Auth
fields are forwarded until consumed, not hop-by-hop.

....Roy

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 30 Apr 2013 12:04:53 +1000

Well, they're listed as hop-by-hop in 2616, and AFAICT we haven't explicitly discussed changing that.

Are you saying that they shouldn't be included in Connection, ever?

---

From: Willy Tarreau <[email-masked]>
Date: Tue, 30 Apr 2013 09:21:32 +0200

> Well, they're listed as hop-by-hop in 2616, and AFAICT we haven't explicitly

Maybe because at the time 2616 was written, intermediaries were almost only
proxies. But I agree with Roy here, if I install haproxy to load-balance a
squid farm, the proxy-auth headers are for squid and not for haproxy. So it's
not hop-by-hop, it's for the first explicit proxy in the chain. So I agree
with Roy here.

> Are you saying that they shouldn't be included in Connection, ever?

I would personally suggest so.

Willy

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 30 Apr 2013 17:27:47 +1000

Makes sense to me. We need to note the change at the end of p1, though, since it's a significant change from 2616.

---

From: "Roy T. Fielding" <[email-masked]>
Date: Tue, 30 Apr 2013 00:58:40 -0700

> Well, they're listed as hop-by-hop in 2616, and AFAICT we haven't explicitly discussed changing that.

It's complicated.  The Proxy-auth fields were defined before
keep-alive and Connection existed.  I remember trying to phrase
that multiple times back in the early days.  In this case, it is
better to simply define how it works without Connection and let
the normal Connection semantics apply when used (if ever).

> Are you saying that they shouldn't be included in Connection, ever?

No, I am just saying that Connection is not required; if it is not
included in Connection, then the intention is that it be forwarded
until consumed.  OTOH, if it is included in Connection, then it
will be consumed or deleted by the immediate recipient.  AFAIK,
these fields are not normally included in Connection, but there
might be a good reason to if the proxy selection is complicated.

....Roy