Re: [http-auth] Working Group Last Call for draft-ietf-httpauth-basicauth-update-03.txt

[Benjamin Kaduk <[e-mail]>]

On Tue, 2 Dec 2014, Yoav Nir wrote:

> Thank you, Julian
>
> This begins a 2-week WGLC for this document.
>
> Please take the time to read through and post any comments to the list.

My apologies if this has already been covered, but the abstract includes
the phrase "obfuscated by the use of Base64 encoding" (the introduction
includes similar content).  It looks like this was introduced in the -01,
and the on-list discussion of the -00 didn't really talk about it -- there
was a note from Bjoern that the abstract "could use another sentence
stating what the `Basic` scheme is", but the word "obfuscate" did not
appear.  As such, I thought I would mention it now -- it's not really
clear that Base64 encoding counts as obfuscation in this context, where
the HTTP headers make it very clear that the userid/password are being
conveyed.


I think the submission checklist wants the abstract (and introduction?) to
explicitly mention when an RFC is being updated or obsoleted.  Relatedly,
the first clause of the introduction says that this document defines
"basic", but the citation to RFC 7235 could be read as if it is a citation
for "basic" (as opposed to HTTP Authentication); perhaps this is better:

% This document defines "Basic" as a Hypertext Transfer Protocol (HTTP)
% Authentication Scheme ([RFC7235]), which transmits credentials as
% Base64-encoded userid/password pairs.


Section 3 says that "Senders can use the new 'charset' parameter", but it
seems that only servers can do so.  Was this intended to say "Servers"
instead of "Senders"?


Section for says that the transmission of the password is "essentially
cleartext", whereas section 1 just says that it is "cleartext".  Which is
it?



Grammar nits:


In section 2:

% 1.  obtains userid and password from the user,

I would add the definite article "the" before "userid" to match the other
items.

In the paragraph following that list, I would s/compatible to/compatible
with/.

In the paragraph following that paragraph, you could add "The" at the
beginning to avoid starting the sentence with the identifier "userid" (and
the ensuing debate about whether to capitalize the initial letter).


-Ben