Re: [http-auth] Pete Resnick's No Objection on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

[Barry Leiba <[e-mail]>]

>>It is, modulo rhetoric.  It's an interoperability requirement.  "You
>>MUST NOT do <x>," means that if you do <x>, you will not interoperate
>>-- something will break.  It seems to me that that's exactly the case
>>here: If my username is "b:leiba", and a client sends "b:leiba:plugh",
>>many servers will think the username is "b" and the password is
>>"leiba:plugh".  That means that allowing ":" in the username breaks
>>interoperability.  Whether or not it works sometimes, and whether or
>>not implementations currently *do* this are irrelevant.  The point is
>>that the right definition of the protocol is that you "MUST NOT have a
>>colon character in the username."
...
> The text suggested by Pete Resnick restricts, in the model above, the
> contents of `$user`, without clear implications for browsers or servers
> or header field value validity. What is it actually that people want
> here? Should browsers be required to check user input for colons? Is it
> okay that the draft requires support for colons in passwords, but does
> not require servers to interpret `b:leiba:plugh` as having a password of
> `leiba:plugh`? Perhaps encoded `user:pass` strings in `Basic` headers
> should be non-conforming if they contain more than one colon?

The bottom line here is that we aren't police, and there are no
consequences for "not conforming".  If, in fact, usernames that
contain colons cause interop problems, what we *should do* in writing
the protocol is to say that usernames MUST NOT contain colons.  If,
despite that, browsers don't check user input, and send usernames with
colons, then the answer is that when they do that they're likely not
to get the results they expect, because that's not valid in the
protocol.  And if someone complains that things broke as a result,
everyone can explain why: having the colon in the username is a
protocol violation.

I don't understand what the argument is about here, because I don't
*think* anyone is arguing that colons *should* be allowed.  I think
the only argument is that sometimes colons *are* sent.  I don't see
that that matters.

Barry