Re: [http-auth] First draft of HTTP Signatures published

[Manu Sporny <[e-mail]>]

On 05/11/2013 11:37 PM, Yoav Nir wrote:
> The HTTP-Auth working group is chartered to work on a very specific
> set of documents. OTOH, the WebSec working group is considering
> adopting a work item for session continuation. Session continuation
> is supposed to be a replacement for authorizing requests via session
> cookies. See the problem statement here:
> 
> http://tools.ietf.org/html/draft-williams-websec-session-continue-prob-00
>
> If I understand correctly, your draft is aiming to solve that issue.
> So you might prefer to take your draft there.

Session management is out-of-scope for the HTTP Signatures spec. It's
true that a session management scheme could be built on top of HTTP
Signatures, but that is a second step. We know that many others are
working on session management right now, and would rather they see if
HTTP Signatures could be useful for them rather than try to shove
session management capabilities into HTTP Signatures.

The HTTP Signatures spec is a fairly simple, straightforward spec as-is.
We'd like to keep it that way. :)

-- manu

-- 
Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
Founder/CEO - Digital Bazaar, Inc.
blog: Meritora - Web payments commercial launch
http://blog.meritora.com/launch/