Subject: Re: [art] Auto-configuring Email Clients via WebFinger
From: "John Levine" <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Date: 16 Jul 2019 18:05:19 -0400
List-Id: Applications and Real-Time Area Discussion <art.ietf.org>

In article <[email-masked]> you write:
>-=-=-=-=-=-
>
>> Putting passwords in cleartext in the request uri is ill advised because many servers keep logs of requests, caches, etc

Good point.

Plan A: if the server needs the user name and password, it sends back
a 401 response and the MUA sends them via RFC 7617 basic
authentication.  That seems largely backward compatible and invents a
minimum of new stuff.

Plan B: do it as a POST like most web password entries.  I realize
this has backward compatibility issues with the current GET.