Subject: RE: Authentication and TCP Connection State

From: "paincompiler"<[email-masked]>
Date: Sat, 4 Oct 2014 00:30:50 +0800

sorry to mention that the link leads to 404.
here’s one copy
http://tools.ietf.org/html/draft-montenegro-httpbis-multilegged-auth-00

Original Message
Sender:Matthew [email-masked]
Recipient:Michael B [email-masked]; [email-masked]@w3.org
Date:Saturday, Oct 4, 2014 00:22
Subject:RE: Authentication and TCP Connection State

It doesnt work, but we had a proposal a couple years ago to address this: http://tools.ietf.org/id/draft-montenegro-httpbis-multilegged-auth-01.txt. Matthew -----Original Message----- From: Michael B Allen [mailto:[email-masked]] Sent: Friday, October 03, 2014 9:11 AM To: [email-masked] Subject: Authentication and TCP Connection State An HTTP authentication sequence looks something like: C: GET /some/thing/6678 S: 401 Unauthorized WWW-Authenticate: MyAwsomeAuth XlwYXNzd29yZA... C: GET /some/thing/6678 Authorization: NTLM MyAwsomeAuth bGxXwYXbxXlYX... S: 200 OK The way this is implemented on the server is to create some authentication state and associate it with the client TCP connection using the clients IP and remote port as an index into a map of ongoing authentication state objects. My question is, can HTTP/2 clients submit multiple requests on the same TCP connection without waiting for responses? If yes, how could HTTP authentication possibly work when there would be no way to lookup the correct authentication state object associated with the submitted auth token? To be more specific, authentication almost always involves sending the client some random data (lets call it a challenge) that the client must then transform using a shared secret and submit that to the server (lets call it a response). So if the server gets two authentication response tokens in sequence, how can the server know which authentication state object matches the supplied response. Meaning it is not possible to match the response with its ch allenge. Mike

---

From: Matthew Cox <[email-masked]>
Date: Fri, 3 Oct 2014 16:33:03 +0000

Thanks, e-mail client included the “.” in the URI. http://tools.ietf.org/id/draft-montenegro-httpbis-multilegged-auth-01.txt

Matthew

From: paincompiler [mailto:[email-masked]]
Sent: Friday, October 03, 2014 9:31 AM
To: Michael B Allen; [email-masked]; Matthew Cox
Subject: RE: Authentication and TCP Connection State

 Original Message
Sender: Matthew Cox<[email-masked]<mailto:[email-masked]>>
Recipient: Michael B Allen<[email-masked]<mailto:[email-masked]>>; [email-masked]<[email-masked]<mailto:[email-masked][email-masked]>>
Date: Saturday, Oct 4, 2014 00:22
Subject: RE: Authentication and TCP Connection State

It doesn&apos;t work, but we had a proposal a couple years ago to address this: http://tools.ietf.org/id/draft-montenegro-httpbis-multilegged-auth-01.txt.

Matthew

-----Original Message-----

From: Michael B Allen [mailto:[email-masked]<mailto:[email-masked]>]

Sent: Friday, October 03, 2014 9:11 AM

To: [email-masked]<mailto:[email-masked]>

Subject: Authentication and TCP Connection State

An HTTP authentication sequence looks something like:

    C: GET /some/thing/6678

    S: 401 Unauthorized

       WWW-Authenticate: MyAwsomeAuth XlwYXNzd29yZA...

    C: GET /some/thing/6678

       Authorization: NTLM MyAwsomeAuth bGxXwYXbxXlYX...

    S: 200 OK

The way this is implemented on the server is to create some authentication state and associate it with the client TCP connection using the client&apos;s IP and remote port as an index into a map of ongoing authentication state objects.

My question is, can HTTP/2 clients submit multiple requests on the same TCP connection without waiting for responses?

If yes, how could HTTP authentication possibly work when there would be no way to lookup the correct authentication state object associated with the submitted auth token?

To be more specific, authentication almost always involves sending the client some random data (let&apos;s call it a "challenge") that the client must then transform using a shared secret and submit that to the server (let&apos;s call it a "response"). So if the server gets two authentication "response" tokens in sequence, how can the server know which authentication state object matches the supplied response.

Meaning it is not possible to match the "response" with it&apos;s "ch allenge".

Mike