RE: Straw-man charter for http-bis -- call for errata/clarifications to 2617

[Henrik Nordstrom <[e-mail]>]

tor 2007-05-31 klockan 14:28 -0700 skrev Eric Lawrence:

> You're right, but Henrik's point still stands.  The existing
> implementation of Negotiate/NTLM is significantly different than the
> conventional HTTP authentication "per-message" model.  It may be
> difficult (or undesirable) to roll this into RFC2616.

I would undesirable. It requires a far too big change in the transport &
message model of HTTP, and in it's current form has some serious (but
partially documented) security implications when using proxies.

HTTP is explicitly designed as a transport-independent message oriented
protocol where each message is self-contained and not dependent on being
sent on a specific transport connection.

RFC4559 is completely connection oriented, with messages far from
self-contained and very dependent of which transport connection is being
used.

Regards
Henrik