Re: [http-auth] UTF-8, usernames, passwords

[Peter Saint-Andre - &yet <[e-mail]>]

On 10/27/14, 6:52 PM, Yutaka OIWA wrote:
> Dear all,
>
> As an author of another PRECIS draft for HTTP authentication
> (http://tools.ietf.org/html/draft-oiwa-precis-httpauthprep-00),
> I personally feel that limiting allowing characters to
> IdentifierClass is feasible and reasonable.
> It includes all "sensible IMO" characters for identifiers,
> is binary compatible with all printable ASCII characters,
> and is character-set compatible with ISO-8859-1 set.
> It will not exclude any printable characters which is currently
> officially allowed in the spec.
>
> We should allow any number of "ASCII SPACE" U+0020
> between printable characters for backward compatibility,

Actually that is allowed by the current rule in saslprepbis:

    username   = userpart [1*(1*SP userpart)]

> and should not forbid any printable ASCII characters
> (except some schema-dependent "forbidden-by-protocol"
> character like colon <:> in basic).
> I strongly believe we should forbid any control characters.
> In both Peter's and my proposals, SPACEs in the
> beginning and the tail of the string is not allowed,
> which can be a target to discuss.
>
> I'm currently trying to seek for possible merger of
> my proposal into saslprepbis, to reduce number of
> profiles to implement.

Yes, that is a good goal.

Peter

-- 
Peter Saint-Andre
https://andyet.com/