Subject: Re: Ticket 237 (absorbing more of 2617), was: Minutes for Maastricht

From: Julian Reschke <[email-masked]>
Date: Mon, 13 Sep 2010 17:58:10 +0200

On 10.08.2010 16:19, Julian Reschke wrote:
> On 29.07.2010 12:07, Julian Reschke wrote:
>> ...
>> I just did some more research:
>>
>> - we'll have to apply
>> <http://www.rfc-editor.org/errata_search.php?eid=1959>
>>
>> - also, it appears that all of
>> <http://greenbytes.de/tech/webdav/rfc2617.html#security.considerations>
>> is specific to Basic and Digest, thus we wouldn't need to copy them
>> over...
>> ...
>
> I have attached a proposed patch to the ticket, see
> <http://trac.tools.ietf.org/wg/httpbis/trac/attachment/ticket/237/i237.diff>.
> ...

Hi,

I just applied the (slightly modified) changes with 
<http://trac.tools.ietf.org/wg/httpbis/trac/changeset/998>; which means 
that ticket 237 can be closed once the next draft is out.

If there are issues with the text that was added we probably should 
treat them as new bugs.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Wed, 22 Sep 2010 17:07:09 +0200

Hi,

there was a left-over from this change... RFC 2617 says in 
<http://greenbytes.de/tech/webdav/rfc2617.html#rfc.section.1.2.p.9>:

"Note that many browsers will only recognize Basic and will require that 
it be the first auth-scheme presented. Servers should only include Basic 
if it is minimally acceptable."

This has two problems: first of all, it's in the wrong place (it should 
be close to the definition of challenges, not credentials). Second, this 
was written in 1999, and surely isn't true anymore. Right? RIGHT?

Wrong.

I checked with

1.

WWW-Authenticate: BASIC realm="basic", UNKNOWN realm="xyz"

2.

WWW-Authenticate: UNKNOWN realm="xyz", BASIC realm="basic"

and

3.

WWW-Authenticate: UNKNOWN realm="xyz"
WWW-Authenticate: BASIC realm="basic"

...and indeed, only variant 1) worked in all browsers 
(FF/IE/Chrome/Safari/Opera) I tried. The only browser that seems to grok 
options 2 and 3 is Safari.

So, apparently a warning is still needed. I have rephrased the Note to:

       Note: Many browsers fail to parse challenges containing unknown
       schemes.  A workaround for this problem is to list well-supported
       schemes (such as "basic") first.

and moved it up below the other note on parsing challenges (see 
<http://trac.tools.ietf.org/wg/httpbis/trac/changeset/1018>).

With respect to the actual browser bug(s): is anybody aware of existing 
bugs in the bug tracking systems? Do we need to raise new ones?

Best regards, Julian

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 22 Sep 2010 17:40:43 +0200

>options 2 and 3 is Safari.

Option #3 seems to work fine for me in non-Webkit browsers. Clearing all
information the browser stores and restarting it seems to be necessary
to get reliable results for some browsers, it seems, perhaps you ran in-
to that problem? (The others indeed seem to not work, but I stopped the
test when it became too silly.)
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Julian Reschke <[email-masked]>
Date: Wed, 22 Sep 2010 17:52:20 +0200

> Option #3 seems to work fine for me in non-Webkit browsers. Clearing all

You are probably right. I forgot that Apache/mod_asis folds this back 
into a single, comma-delimited header.

> test when it became too silly.)

Potentially. I need to figure out a better way to test things like that.

Best regards, Julian

---

From: Thomas Broyer <[email-masked]>
Date: Thu, 23 Sep 2010 00:42:29 +0200

On Wed, Sep 22, 2010 at 5:52 PM, Julian Reschke wrote:
> You are probably right. I forgot that Apache/mod_asis folds this back into a
> single, comma-delimited header.
>

See http://hg.ltgt.net/http-cookie-auth/file/tip/tests (the asis.py script)

Results at:
http://www.w3.org/mid/[email-masked]
http://lists.osafoundation.org/pipermail/ietf-http-auth/2009-January/000547.html
and http://lists.osafoundation.org/pipermail/ietf-http-auth/2009-January/000562.html

I haven't tested with newer browser versions.

-- 
Thomas Broyer
/tɔ.ma.bʁwa.je/