Re: [http-auth] Working Group Last Call for draft-ietf-httpauth-basicauth-update-03.txt

[Julian Reschke <[e-mail]>]

On 2014-12-02 12:19, Yoav Nir wrote:
> Thank you, Julian
>
> This begins a 2-week WGLC for this document.
>
> Please take the time to read through and post any comments to the list.
>
> Cheers
>
> Matt & Yoav
> ...

...and the WGLC ended yesterday.

My current edits are over here:

 
<http://greenbytes.de/tech/webdav/draft-ietf-httpauth-basicauth-update-latest-from-previous.diff.html>

Those are all editorial, mostly based on WGLC feedback (thanks).

In the LC, there were also requests to change prose to use more BCP14 
terms, and also to make the use of the charset parameter required; I did 
not make any changes with respect to this, because:

- I believe our use of BCP14 terms is consistent with the HTTP specs, and

- The whole premise of introducing the charset parameter was to leave 
existing conforming implementations conforming; thus it was always meant 
to be truly OPTIONAL.

Finally, while reviewing DIGEST, I noticed that there are security 
considerations in RFC 2617 that should have been in RFC 7235, namely:

  <http://greenbytes.de/tech/webdav/rfc2617.html#rfc.section.4.6>

and

  <http://greenbytes.de/tech/webdav/rfc2617.html#rfc.section.4.8>

I believe the best way to address this is to track this as a TODO for 
RFC7235bis (which I intend to get to in due time).

Chairs: should I submit what I currently have, or are more changes needed?

Best regards, Julian