Subject: Re: Syntax for WWW-Authenticate

From: [email-masked]
Date: Wed, 8 Dec 1999 20:26:18 +0530

Hi,
since the syntax specifies that all parameters must be of type token=token,
so a parser should, if it sees only  a token, assume its a new  auth-scheme
since  there is no = after it, and can hence
take it as a new www-auth header (taking care of LWSs around)

(btw, the sipgrammar html file for www-auth incorrectly states it as
auth-scheme 1#challenge -- it should only be 1#challenge as auth-scheme is
contained in it)

why do you say that this is difficult and should be discouraged ? Infact I
think things like nested comments inbetween params are more difficult and
still allowed ?

regds
Arjun

--
Arjun Roychowdhury @ Hughes Software Systems

Henning Schulzrinne <[email-masked]> on 12/08/99 07:43:06 PM

To:   [email-masked]
cc:
Subject:  Syntax for WWW-Authenticate

The Authorization and WWW-Authenticate headers have truly awful syntax
(*), since they allow the use of commas for both parameter and header
separation. The following is legal to declare one's ability to support
both basic and digest authentication:
WWW-Authenticate: basic realm=br, digest realm=dr, nonce=hex,
                  more=parameter
Note that the only way to tell that a new header has begun is to either
recognize "digest" (dangerous, since new mechanisms could be invented)
or to see that two words are separated by white space, rather than
comma. This means that the parser has to look ahead to decide what to do
and can't split headers.
My suggestion would be to strongly discourage this syntax and only use
the equivalent
WWW-Authenticate: basic realm=br, par=value, par=value
WWW-Authenticate: digest realm=dr, ...
instead. The pain of supporting the single-header form just doesn't seem
worth it.
Henning
(*) which we inherited from HTTP, just to place blame properly :-)

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 08 Dec 1999 14:47:56 -0500

> so a parser should, if it sees only  a token, assume its a new  auth-scheme

That's what I said, yes.

> take it as a new www-auth header (taking care of LWSs around)

Because a parser cannot split the header first and then parse each one
individually. This is the only instance in HTTP where a parser needs to
"look ahead" or "back up". Generally, since Fortran, language-writers
have tried to avoid this, for a good reason.

This makes writing a generic parser much more difficult than it should
be, for no gain in functionality.

> think things like nested comments inbetween params are more difficult and

Separate issue and easily handled in a few lines of code.

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs