Subject: Ambiguous case in WWW-Authenticate grammar?

From: Jesse Wilson <[email-masked]>
Date: Sun, 20 Apr 2014 22:15:46 -0400

I’m working on improving the Challenge/Credential API of
OkHttp<https://github.com/square/okhttp>and I’ve stumbled across a
curious case in the grammar. Specifically in auth
section 2.1<https://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-26#section-2.1>),
which says this:

   challenge   = auth-scheme [ 1*SP ( token68 / #auth-param ) ]
   auth-param  = token BWS "=" BWS ( token / quoted-string )
   token68     = 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) *"="

Suppose I receive this response header:

WWW-Authenticate: Wink ABC=

Is ABC= a four character token68? Or is it a parameter named ABC whose
value is the empty string?

My current plan is to defer interpreting the header until the application
layer requests it. But that approach is not particularly satisfying.

Thanks!

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 21 Apr 2014 05:48:32 +0300

> value is the empty string?

AFAICT, it is token68.

Neither token nor quoted-string can expand into empty string. Nor can
those expand into string of '='.

-Ilari

---

From: Jesse Wilson <[email-masked]>
Date: Sun, 20 Apr 2014 23:01:52 -0400

Yup, that's right. I missed the fact that tokens are non-empty. Thanks!