IETF Logo Mail Archive

[http-auth] ignoring unknown parameters, Re: Last Call: <draft-ietf-httpauth-basicauth-update-05.txt> (The 'Basic' HTTP Authentication Scheme) to Proposed Standard

Julian Reschke <julian.reschke@greenbytes.de> Tue, 10 February 2015 17:38 UTC

Return-Path: <julian.reschke@greenbytes.de>
X-Original-To: http-auth@ietfa.amsl.com
Delivered-To: http-auth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D78E91A1A90; Tue, 10 Feb 2015 09:38:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.561
X-Spam-Level:
X-Spam-Status: No, score=-1.561 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UVQELyqPDurR; Tue, 10 Feb 2015 09:38:47 -0800 (PST)
Received: from mail.greenbytes.de (mail.greenbytes.de [217.91.35.233]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 650851A1A63; Tue, 10 Feb 2015 09:38:47 -0800 (PST)
Received: from [192.168.1.26] (unknown [217.91.35.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by mail.greenbytes.de (Postfix) with ESMTPSA id E446B15A0270; Tue, 10 Feb 2015 18:38:45 +0100 (CET)
Message-ID: <54DA4225.1020900@greenbytes.de>
Date: Tue, 10 Feb 2015 18:38:45 +0100
From: Julian Reschke <julian.reschke@greenbytes.de>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Bjoern Hoehrmann <derhoermi@gmx.net>, ietf@ietf.org
References: <20150205161049.4222.88369.idtracker@ietfa.amsl.com> <kdr7da51k6t581cdppljqvdnf6401cjb4o@hive.bjoern.hoehrmann.de> <54D462A6.1030709@gmx.de>
In-Reply-To: <54D462A6.1030709@gmx.de>
Content-Type: text/plain; charset="windows-1252"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/http-auth/VeySoD9WRqXrq-pn9n2UDXsj6WQ>
Cc: http-auth@ietf.org
Subject: [http-auth] ignoring unknown parameters, Re: Last Call: <draft-ietf-httpauth-basicauth-update-05.txt> (The 'Basic' HTTP Authentication Scheme) to Proposed Standard
X-BeenThere: http-auth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: HTTP authentication methods <http-auth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/http-auth>, <mailto:http-auth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/http-auth/>
List-Post: <mailto:http-auth@ietf.org>
List-Help: <mailto:http-auth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/http-auth>, <mailto:http-auth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 10 Feb 2015 17:38:49 -0000

On 2015-02-06 07:43, Julian Reschke wrote:
> ...
>> There should be an example for "no other authentication parameters are
>> defined -- unknown parameters MUST be ignored by recipients", otherwise
>> such extension points are too easily missed by implementers.
>
> <http://greenbytes.de/tech/tc/httpauth/#simplebasicnewparam2> shows that
> UAs seem to get at least this correct. I'll think about it.

OK. In my tests I don't see anybody getting *that* wrong, and the new 
text already is much clearer than RFC 2617 ever was.

Thus I don't think we need an example here. Also note that the real 
challenge (pun intended) is to parse multiple challenges properly; this 
is something many UAs *do* get wrong despite the prose in both RFC 2617 
and RFC 7235.

Best regards, Julian

v2.23.0 | Report a Bug | By Email