Subject: Fwd: I-D Action:draft-reschke-basicauth-enc-01.txt

From: Julian Reschke <[email-masked]>
Date: Mon, 16 Aug 2010 16:24:23 +0200

FYI:

This revision adds a discussion about why there's no parameter for the 
credentials (KISS), and a rewrite of the deployment considerations.

Best regards, Julian

-------- Original Message --------
Subject: I-D Action:draft-reschke-basicauth-enc-01.txt
Date: Mon, 16 Aug 2010 07:15:02 -0700 (PDT)
From: [email-masked]
Reply-To: [email-masked]
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.

	Title           : An Encoding Parameter for HTTP Basic Authentication
	Author(s)       : J. Reschke
	Filename        : draft-reschke-basicauth-enc-01.txt
	Pages           : 9
	Date            : 2010-08-16

The "Basic" authentication scheme defined in RFC 2617 does not
properly define how to treat non-ASCII characters.  This has lead to
a situation where user agent implementations disagree, and servers
make different assumptions based on the locales they are running in.
There is little interoperability for characters in the ISO-8859-1
character set, and even less interoperability for any characters
beyond that.

This document defines a backwards-compatible extension to "Basic",
specifying the server's character encoding expectation, using a new
authentication scheme parameter.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-reschke-basicauth-enc-01.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: "Anne van Kesteren" <[email-masked]>
Date: Mon, 16 Aug 2010 16:31:13 +0200

> credentials (KISS), and a rewrite of the deployment considerations.

If we do not want people to use Basic auth, should we really add new  
features?

-- 
Anne van Kesteren
http://annevankesteren.nl/

---

From: Julian Reschke <[email-masked]>
Date: Mon, 16 Aug 2010 16:40:19 +0200

On 16.08.2010 16:31, Anne van Kesteren wrote:
> On Mon, 16 Aug 2010 16:24:23 +0200, Julian Reschke
> <[email-masked]> wrote:
>> FYI:
>>

1) I have no problem with people doing Basic auth, as long as it happens 
over a secure connection, or the implications of not doing so are well 
understood. (*`)

2) This fixes an age-old interop problem, and does so with very limited 
cost.

Best regards, Julian

(*) If you believe that people shouldn't do Basic auth, how about 
lobbying both in the W3C and the IETF not to use Basic Auth for their 
own sites?