Re: [http-auth] Stephen Farrell's Yes on draft-ietf-httpauth-basicauth-update-06: (with COMMENT)

[Julian Reschke <[e-mail]>]

On 2015-02-17 02:52, Stephen Farrell wrote:
> ...
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
>
> This is a pretty crappy auth scheme, but this is a pretty
> good update and fills a need, thanks for the latter:-)

Thanks :-)

> - section 2: is it worth saying somewhere that you can't
> really have >1 proxy-auth happening even if you transit >1
> proxy?

Somewhere yes, but not here. When we do RFC7235bis, I'd like to get the 
proxy auth parts some attention, and that needs feedback from people who 
actually do have some experience with it (which I do not).

> - section 2, last para: I assume this is because client
> and/or server behaviour varies for this? If so, maybe it'd

Yes.

> be good to give some guidance or add a reference (if a
> good one exists). If there's some other reason, it'd be
> good to say too.

I don't have a reference nor guidance. UAs behave differently and are 
allowed to do so. I don't think we can say something beyond that.

> - section 4: would it be worth adding some guidance that
> re-use of e.g. entreprise login/SSO passwords for
> proxy-auth is particularly dodgy as is not protected via
> TLS?

There's a lot of things that can be said about the topic of password 
choice and re-use. Is it specific to Basic auth? I'm not opposed to add 
something, but this sounds like an open-ended topic. If you have a 
concrete proposal for text, I'm all ears :-)

Best regards, Julian