Re: [http-auth] WGLC for draft-ietf-httpauth-hoba-04

[Stephen Farrell <[e-mail]>]

Hiya,

On 06/10/14 16:04, Julian Reschke wrote:
>> 
> 
> Wait. You can't just introduce a new HTTP header field (not HTTP
> header) in passing.

Heh, I figured the header (field) police would catch up with me
at some point:-) And that's ok, better to do it right.

Can you tell me the difference here between a HTTP header field
and a HTTP header?

> If you need a new header field, please have a separate section with
> a precise definition of what it is about, and when writing that,
> please follow the guidance in 
> <http://svn.tools.ietf.org/svn/wg/httpbis/specs/rfc7231.html#considerations.for.new.header.fields>.

I'll look that over, but first...

>
> That being said; are you sure you need an additional header field?

I *think* we do. The issue is that the UA needs to know when
it can use HOBA which means it needs to know when it has succeeded
in registration. And since registration can be a multiple-exchange
application layer thing, we need a way to signal the successful end
of that back to the UA. So the earlier discussion with Michael ended
up with a header field that the server can put into the "last" HTTP
response that was needed for successful registration. If there's a
better/easier/more-correct way then to handle this then I'd be just
fine with that too, whatever it is.

Cheers,
S.