Re: [http-auth] Pete Resnick's No Objection on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

[Bjoern Hoehrmann <[e-mail]>]

* Julian Reschke wrote:
>The problem here is the "long tail". We simply have no information about 
>whether these IDs exist in practice. The fact that all UAs I checked 
>indeed accept them at least *hints* that they might be used somewhere. 
>Or none of the implementers ever thought about rejecting them.
>
>I don't believe we can find out what the reason for this is.
>
>In RFC 2617, the pseudo-ABNF prose production excluded the colon, but no 
>additional prose requirements were present.
>
>In the draft, we have replaced that pseudo-ABNF by prose, and that prose 
>not only says "invalid" but also explains what common UAs do, and how 
>that might affect results. I hope everybody agrees that this is an 
>improvement over what we had before.

The current text is:

   Furthermore, a user-id containing a colon character is invalid, as
   recipients will split the user-pass at the first occurrence of a
   colon character.  Note that many user agents however will accept a
   colon in user-id, thereby producing a user-pass string that
   recipients will likely treat in a way not intended by the user.

So if the password contains a colon, and the draft requires support for
that, then what? Are recipients REQUIRED to split the string at the 1st
colon? If so, then I think the current text is not adequate. If not,
then it seems wrong to require support for colons in passwords.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
D-10243 Berlin · PGP Pub. KeyID: 0xA4357E78 · http://www.bjoernsworld.de
 Available for hire in Berlin (early 2015)  · http://www.websitedev.de/