Re: [http-auth] Pete Resnick's No Objection on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

[Julian Reschke <[e-mail]>]

On 2015-02-19 00:42, Barry Leiba wrote:
>>> "MUST NOT" does not mean the Internet Police will come to take you away.
>>> "MUST NOT" means "this won't work".
>>
>> Ahem, no, that's not what "MUST NOT" means.
>
> It is, modulo rhetoric.  It's an interoperability requirement.  "You
> MUST NOT do <x>," means that if you do <x>, you will not interoperate
> -- something will break.  It seems to me that that's exactly the case
> here: If my username is "b:leiba", and a client sends "b:leiba:plugh",
> many servers will think the username is "b" and the password is
> "leiba:plugh".  That means that allowing ":" in the username breaks
> interoperability.  Whether or not it works sometimes, and whether or

Allowing colons in usernames when usernames are assigned is a problem. 
We already say these names are invalid.

Requiring UAs to reject them is an entirely different story. If a user 
id *did* contain the colon, and did "work" for some UA A and server B, 
implementing the "MUST NOT" in the UA would remove the user's ability to 
log on to the web site. That's a bigger failure.

> not implementations currently *do* this are irrelevant.  The point is
> that the right definition of the protocol is that you "MUST NOT have a
> colon character in the username."

They are invalid, and we already say that.

Best regards, Julian