Re: [apps-discuss] [websec] HTTP authentication: the next generation

[Marsh Ray <[e-mail]>]

On 12/10/2010 04:53 PM, Peter Saint-Andre wrote:
> Is it time to start thinking about next-generation authentication
> technologies for HTTP?

No? :-)

IMHO, authentication just doesn't belong at the HTTP layer.

HTTP is inherently bad at being stateful. Stateless interfaces can be 
fantastic, but it doesn't support the "login session" concept that most 
people have in mind when they talk about authentication.

Unless you're properly using TLS, you have no reason to believe that the 
byte you just received is from the same party as the previous byte you 
received. So under those circumstances, what exactly are you 
authenticating, and to whom?

I use a lot of web sites and none of them do authentication via HTTP. 
Every single one of them expects a username/password via HTTP(s) POST 
variables and returns a cookie of varying duration.

But what could we possibly do for a stateless, unMACed protocol like 
HTTP, except integrate and bind it better with a lower layer providing 
real integrity?

I think what the world needs are ways for web apps (literally, the Ruby 
code) to easily work with the strongly-authenticated identities which 
are supported at the TLS layer. TLS already supports "sessions" and 
"client authentication", but for whatever reasons they're not being 
utilized. We should make using those facilities as easy for web 
developers as doing cookie-based logins.

Improving the "authentication" for a protocol lacking basic message 
integrity would just be giving a false sense of security. It's like 
improving the login authentication for telnet or FTP sessions.

But I do think there are lots of improvements waiting to be made in the 
right directions.

- Marsh