Re: [http-auth] Pete Resnick's No Objection on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

[Kathleen Moriarty <[e-mail]>]

Hi,

On Thu, Feb 19, 2015 at 2:15 AM, Julian Reschke <[e-mail]>
wrote:

> On 2015-02-19 00:42, Barry Leiba wrote:
>
>> "MUST NOT" does not mean the Internet Police will come to take you away.
>>>> "MUST NOT" means "this won't work".
>>>>
>>>
>>> Ahem, no, that's not what "MUST NOT" means.
>>>
>>
>> It is, modulo rhetoric.  It's an interoperability requirement.  "You
>> MUST NOT do <x>," means that if you do <x>, you will not interoperate
>> -- something will break.  It seems to me that that's exactly the case
>> here: If my username is "b:leiba", and a client sends "b:leiba:plugh",
>> many servers will think the username is "b" and the password is
>> "leiba:plugh".  That means that allowing ":" in the username breaks
>> interoperability.  Whether or not it works sometimes, and whether or
>>
>
> Allowing colons in usernames when usernames are assigned is a problem. We
> already say these names are invalid.
>
> Requiring UAs to reject them is an entirely different story. If a user id
> *did* contain the colon, and did "work" for some UA A and server B,
> implementing the "MUST NOT" in the UA would remove the user's ability to
> log on to the web site. That's a bigger failure.


Pete and Barry are making the point that text in this draft can help clear
this issue up going forward.  If a user id contained a colon, the user
would need a new id if user agents decided this should not work.  Since
browsers do support this now, there must be some instances where this
occurred to change their behavior, moving away from standard specifications
to allow this, is that true?  I haven't seen user ids with :s in them, but
that could just be me being unaware of this practice.

I'm not reading this discussion as resolved yet.

Thanks,
Kathleen

>
>
>  not implementations currently *do* this are irrelevant.  The point is
>> that the right definition of the protocol is that you "MUST NOT have a
>> colon character in the username."
>>
>
> They are invalid, and we already say that.
>
> Best regards, Julian
>



-- 

Best regards,
Kathleen