Subject: Ambiguity parsing WWW-Authenticate value

From: cowwoc <[email-masked]>
Date: Tue, 8 Jul 2014 21:32:48 -0700 (PDT)

http://tools.ietf.org/html/rfc7235#section-4.1 contains the following
example:

WWW-Authenticate: Newauth realm="apps", type=1,
                       title="Login to \"apps\"", Basic realm="simple"

This is meant to represent two challenges.

How is a parser supposed to differentiate between different challenges and
the parameters belonging to the previous challenge? I can only assume that
challenges are identified as a key without a value, whereas parameters must
have a value. Is that correct?

If so, you might want to mention this explicitly in the specification
because it's not immediately obvious.

Gili

--
View this message in context: http://w3-org.9356.n7.nabble.com/Ambiguity-parsing-WWW-Authenticate-value-tp286694.html
Sent from the w3.org - ietf-http-wg mailing list archive at Nabble.com.

---

From: Julian Reschke <[email-masked]>
Date: Wed, 09 Jul 2014 08:35:11 +0200

> have a value. Is that correct?

A scheme name is followed by whitespace and a parameter (if any).

I wrote a regexp-based parser based on the ABNF and it works just fine, 
see <http://greenbytes.de/tech/tc/httpauth/>.

> because it's not immediately obvious.

Well, the specification was just published, so it's a bit late for 
editorial suggestions like this one...

Best regards, Julian