Resent-Date: Wed, 17 Jul 2013 07:02:20 +0000
Resent-Message-Id: <E1UzLki-0000km-D6@frink.w3.org>
From: Yoav Nir <ynir@checkpoint.com>
To: HTTP Working Group <ietf-http-wg@w3.org>
Thread-Topic: Authentication over HTTP
Thread-Index: AQHOgOhES0WdbZPy4Uas4RMGBbjKjJllG2kAgAGKsICAAD2RAIAAL3yAgABOEQCAANBTgIAACWsAgAAH6oA=
Date: Wed, 17 Jul 2013 07:01:41 +0000
Message-ID: <C4372D96-77AC-4F1E-AE5E-B87E4772084A@checkpoint.com>
References: <CE0AD74C.22464%Josh.Howlett@ja.net>
 <51E5428D.7010008@treenet.co.nz>
 <CAK3OfOg9JZbcnZhHSNrfSViNeV+wyctwYzSKhXpjGf3f_gP+VQ@mail.gmail.com>
 <51E632CB.9010107@treenet.co.nz>
 <alpine.LRH.2.01.1307162329540.26279@egate.xpasc.com>
In-Reply-To: <alpine.LRH.2.01.1307162329540.26279@egate.xpasc.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-ID: <80A6B368627CFD438F7F204A64D3A5FC@ad.checkpoint.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Received-SPF: pass client-ip=194.29.34.68; envelope-from=ynir@checkpoint.com;
 helo=smtp.checkpoint.com
Subject: Re: Authentication over HTTP
Archived-At: <http://www.w3.org/mid/C4372D96-77AC-4F1E-AE5E-B87E4772084A@checkpoint.com>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

On Jul 17, 2013, at 9:33 AM, David Morris <dwm@xpasc.com> wrote:

> On Wed, 17 Jul 2013, Amos Jeffries wrote:
>=20
>>=20
>> What am I missing?
>=20
> How about the user experience sucks because the authentication doesn't fi=
t
> into the style/face of the application and doesn't provide sufficient use=
r
> context for the prompts generated by the auth mechanicanism so the
> application owners design and implement their own approach? Oh, and no
> logout mechanism to cancel browser caching of credentials?

There is at least one attempt to address the user experience issue, by havi=
ng an unauthenticated as well as an authenticated version of the page (pres=
umably with the unauthenticated version pointing you at the credential entr=
y box that is located in the chrome of the browser)

There's even a modified browser to demonstrate this:

https://www.rcis.aist.go.jp/special/MutualAuth/index-en.html

Yoav (who is in no way affiliated with this site, but is the chair of http-=
auth where their draft is discussed)