Re: [http-auth] Pete Resnick's No Objection on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

[Julian Reschke <[e-mail]>]

On 2015-02-18 22:49, Pete Resnick wrote:
> ...
 > -----------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> 2: I'd at least like to hear an explanation about why this is
> unreasonable (if it is):
>
> OLD
>     Furthermore, a user-id containing a colon character is invalid, as
>     recipients will split the user-pass at the first occurrence of a
>     colon character.  Note that many user agents however will accept a
>     colon in user-id, thereby producing a user-pass string that
>     recipients will likely treat in a way not intended by the user.
> NEW
>     Furthermore, a user-id MUST NOT contain a colon character, as
>     recipients will split the user-pass at the first occurrence of a
>     colon character.  Many user agents will accept a colon in user-id,
>     but this produces a user-pass string that recipients will likely
>     treat in a way not intended by the user.
> END
>
> MUST NOT means that not using a colon is required for interoperation.
> Which is true. So I don't see why you don't come out and say that.
> ...

I just tested Firefox, Chrome, and IE. All of them accept colons in user 
ids and do exactly what the spec currently says. It seems pointless to 
me to say "MUST NOT" when it's widely implemented that way. In a new 
protocol I'd prefer and mandate "fail early", but this is not a new 
protocol.

Best regards, Julian