Re: [http-auth] Pete Resnick's No Objection on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

[Bjoern Hoehrmann <[e-mail]>]

* Julian Reschke wrote:
>On 2015-02-19 23:33, Bjoern Hoehrmann wrote:
>> The current text is:
>>
>>     Furthermore, a user-id containing a colon character is invalid, as
>>     recipients will split the user-pass at the first occurrence of a
>>     colon character.  Note that many user agents however will accept a
>>     colon in user-id, thereby producing a user-pass string that
>>     recipients will likely treat in a way not intended by the user.
>>
>> So if the password contains a colon, and the draft requires support for
>> that, then what? Are recipients REQUIRED to split the string at the 1st
>> colon? If so, then I think the current text is not adequate. If not,
>> then it seems wrong to require support for colons in passwords.
>
>I think they are required to split on the first colon; why do you think 
>the current text is inadequate?

It should be something like

  The first colon in a user-pass string separates username and password
  from one another; text after the first colon is part of the password.
  Usernames containing colons cannot be encoded in user-pass strings.
  Note that many user agents produce user-pass strings without checking
  that usernames supplied by users do not contain colons; recipients
  will then treat part of the username input as part of the password.

This would actually define the correct interpretation of the first colon
rather than hinting at what recipients will do, avoid the "will likely"
speculation, and makes it more clear that colons in usernames are not an
option offered by the protocol that then needs to be restricted by a
MUST NOT for interoperability reasons, as far as I am concerned. It is
also more clear that "user agents accept colons" is an UI issue; with
the text in the draft `user-id` is used for both "string entered into
username form field" and "value in Authorization header" which can be
quite different due to colons.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
D-10243 Berlin · PGP Pub. KeyID: 0xA4357E78 · http://www.bjoernsworld.de
 Available for hire in Berlin (early 2015)  · http://www.websitedev.de/