Re: [http-auth] Pete Resnick's No Objection on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

[Bjoern Hoehrmann <[e-mail]>]

* Pete Resnick wrote:
>2: I'd at least like to hear an explanation about why this is
>unreasonable (if it is):
>
>OLD
>   Furthermore, a user-id containing a colon character is invalid, as
>   recipients will split the user-pass at the first occurrence of a
>   colon character.  Note that many user agents however will accept a
>   colon in user-id, thereby producing a user-pass string that
>   recipients will likely treat in a way not intended by the user.
>NEW
>   Furthermore, a user-id MUST NOT contain a colon character, as
>   recipients will split the user-pass at the first occurrence of a
>   colon character.  Many user agents will accept a colon in user-id,
>   but this produces a user-pass string that recipients will likely
>   treat in a way not intended by the user.
>END
>
>MUST NOT means that not using a colon is required for interoperation.
>Which is true. So I don't see why you don't come out and say that.

The intent is to say that usernames containing colons are not supported
by the scheme because first colon in `user:pass` strings separates the
username from the password and there is no escaping mechanism. It would
be incorrect to phrase that as a "MUST NOT".
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
D-10243 Berlin · PGP Pub. KeyID: 0xA4357E78 · http://www.bjoernsworld.de
 Available for hire in Berlin (early 2015)  · http://www.websitedev.de/