[calsify] Anonymous bootstrapping ala RFC 6764

[Дилян Палаузов <[e-mail]>]

Hello,

RFC 6764 describes a bootstrapping function.  The input of the function is a mailto: or http(s): URL and the output is a
webaddress, towards which a current-user-principle request can be made.

Obviously, a CalDAV/CardDAV server can offer resources not only to authenticated users, but also to unauthenticated
ones.  

A supoptimal way to offer calendar resources to unauthenticated users is, to publish an iCalendar file, which users
download completly, whenever its ETag changes.

The bootstrapping function has the advantage, that it implies that updates are done over the WebDAV Collection
Synchronization protocol and for any domain, users can find in standard way of offered calendars (no need of
descriptions in HTML for advanced users).

How to perform the bootstrapping for unauthenticated users?

For mailto: URLs, these can be of the form @domain , for http urls, these can be without username, say 
https://caldav.example.org/ (the opposite would be https://[e-mail]/).

A server supporting both authenticated and unauthenticated users will answer every query during the bootstrapping,
without ever returning 401.  Without seeing 401 clients do not know, which authentication schemas are supported and,
ofter, do not try to authenticate.  One way to find the available WWW-auth-mechanisms is to send invalid username as
Authorization, other possibilities are e.g. to send OPTIONS call and to include in its result the supported schemas.

RFC 7235 (HTTP/1.1: Authentication) permits authentication without waiting for 401 answer “ A user agent that wishes to
authenticate itself with an origin server -- usually, but not necessarily, after receiving a 401 (Unauthorized) -- can
do so by including an Authorization header field with the request.”.

So it is ultimately the user, who knows whether she wants to authenticate or not.

Does this need a separate internet draft?

Regards
  Дилян