Re: [http-auth] [Mutual] (due Aug 28) Mutual auth issues (part 1)

[Sophie Bremer <[e-mail]>]

Hi Yutaka,

answers below:

> ==== draft-ietf-httpauth-mutual ====
> 
> = Section 3.1 =
> 
> [P1] Is adoption of RFC5987 OK?
> https://github.com/yoiwa/httpauth-mutual/issues/1

It looks good. Even so pwd-hash*=UTF-8''ABCDEF or other token values do not make sense, the involved parties should support it in favor of future flexibility.

> [P2] The encoding is fixed to UTF-8, without any language.
>    (justification: it is not an on-line negotiable parameter,
>     and the new protocol does not need to consider older
>     clients.)
> https://github.com/yoiwa/httpauth-mutual/issues/2

This makes implementation at the low level easier, so I find it reasonable.

> = Section 4: Messages =
> 
> [P3] Are the reserved parameter names making sense?
> https://github.com/yoiwa/httpauth-mutual/issues/3

--
4.3 401-KEX-S1

  path:          (non-mandatory, string) specifies which path in the
                 URI space the same authentication is expected to be
                 applied.  The value is a space-separated list of URIs,
                 in the same format as it was specified in domain
                 parameter [RFC2617] for the Digest authentications.
--

What is the reason to use the parameter name "path" instead of "domain"?
Wiktionary says:

--
domain ‎(plural domains)

	• A geographic area owned or controlled by a single person or organization.
The king ruled his domain harshly.
	• A field or sphere of activity, influence or expertise.
Dealing with complaints isn't really my domain: get in touch with customer services.
His domain is English history.
	• A group of related items, topics, or subjects.
--

I am in favor of the name "domain" for continuity between authentication specs as you may have guessed by now. :)

> Thank you for your cooperation.

Regards,

Sophie