Subject: combining authenticated and anonymous access

From: Julian Reschke <[email-masked]>
Date: Thu, 27 Nov 2008 19:48:53 +0100

Hi,

over on the what wg list, the topic of how to implement a site that 
offers both authenticated and anonymous access is being discussed (see 
around 
<http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2008-November/017562.html>).

An interesting proposal is to continue returning content with status 
200, but to include the WWW-Authenticate header nevertheless. RFC2616 
currently is silent about this combination:

"14.47 WWW-Authenticate

The WWW-Authenticate response-header field MUST be included in 401 
(Unauthorized) response messages. The field value consists of at least 
one challenge that indicates the authentication scheme(s) and parameters 
applicable to the Request-URI.

     WWW-Authenticate  = "WWW-Authenticate" ":" 1#challenge

The HTTP access authentication process is described in "HTTP 
Authentication: Basic and Digest Access Authentication" [43]. User 
agents are advised to take special care in parsing the WWW-Authenticate 
field value as it might contain more than one challenge, or if more than 
one WWW-Authenticate header field is provided, the contents of a 
challenge itself can contain a comma-separated list of authentication 
parameters." -- 
<http://greenbytes.de/tech/webdav/rfc2616.html#rfc.section.14.47>

Has anybody tried this before?

BR, Julian

---

From: Thomas Maslen <[email-masked]>
Date: Thu, 27 Nov 2008 12:35:12 -0800

Julian Reschke [email-masked] wrote:

> [...] An interesting proposal is to continue returning content with status 200, but to include the WWW-Authenticate header nevertheless.  RFC2616 currently is silent about this combination

Note that there is at least one scenario where a response with 200 status (and content) may already include a "WWW-Authenticate" header.  See RFC 4559, section 4.1, "A status code 200 response can also carry a 'WWW-Authenticate' response header containing the final leg of an authentication".

Of course the difference between this and the proposal you cited is that in RFC 4559 this only happens after the client has sent an "Authorization: Negotiate <big Base64 blob>" header [*] and the server has used that to authenticate the client, whereas in the proposal you're looking at this would happen when the client has not authenticated to the server (but the server is happy with unauthenticated clients).

[*] This can happen either because the most recent response from the server was a 401 with a "WWW-Authenticate: Negotiate" challenge or because the client decides to preemptively send the Authorization header -- Internet Explorer does this for every POST (and, I assume, for any other HTTP request that has a content-body) after it discovers that the server expects Negotiate authentication

---

From: Yves Lafon <[email-masked]>
Date: Thu, 27 Nov 2008 16:20:04 -0500 (EST)

On Thu, 27 Nov 2008, Julian Reschke wrote:

> An interesting proposal is to continue returning content with status 200, but 
> to include the WWW-Authenticate header nevertheless. RFC2616 currently is 
> silent about this combination:
[..]

> Has anybody tried this before?

I saw that on a very popular server due to an error in one extension, some 
browser rendered the pages correctly, some other prompted the user for 
authentication (despite the 200 status code).

-- 
Baroula que barouleras, au tiéu toujou t'entourneras.

         ~~Yves

---

From: Julian Reschke <[email-masked]>
Date: Fri, 28 Nov 2008 12:33:20 +0100

Yves Lafon wrote:
> I saw that on a very popular server due to an error in one extension, 
> some browser rendered the pages correctly, some other prompted the user 
> for authentication (despite the 200 status code).

I just tried it with Opera/FF/Safari/IE7/Chrome (latest Windows XP 
version), and none of them prompted the user...

BR, Julian

---

From: Yves Lafon <[email-masked]>
Date: Fri, 28 Nov 2008 07:58:25 -0500 (EST)

On Fri, 28 Nov 2008, Julian Reschke wrote:

>>> An interesting proposal is to continue returning content with status 200, 
>>> but to include the WWW-Authenticate header nevertheless. RFC2616 currently 
>>> is silent about this combination:
>> [..]
>> 
> I just tried it with Opera/FF/Safari/IE7/Chrome (latest Windows XP version), 
> and none of them prompted the user...

w3m is, and some other text-based tools.

         ~~Yves

---

From: Julian Reschke <[email-masked]>
Date: Fri, 28 Nov 2008 14:58:31 +0100

Yves Lafon wrote:
> ...
> ...

OK, so do we consider this a bug, or just a result of unspecified behavior?

BR, Julian