Question on Multiplicity of Authorization and WWW-Authenticate

Jan Algermissen <jan.algermissen@nordsc.com> Tue, 16 April 2013 11:56 UTC

Resent-Date: Tue, 16 Apr 2013 11:55:36 +0000
Resent-Message-Id: <E1US4U4-000462-9D@frink.w3.org>
From: Jan Algermissen <jan.algermissen@nordsc.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Message-Id: <0F597111-A3C0-45D6-84EB-E357B5AEAA26@nordsc.com>
Date: Tue, 16 Apr 2013 13:55:07 +0200
To: ietf-http-wg@w3.org
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
Received-SPF: none client-ip=212.227.126.171; envelope-from=jan.algermissen@nordsc.com; helo=moutng.kundenserver.de
Subject: Question on Multiplicity of Authorization and WWW-Authenticate
Archived-At: <http://www.w3.org/mid/0F597111-A3C0-45D6-84EB-E357B5AEAA26@nordsc.com>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

Hi,

I was wondering whether there can be multiple Authorization headers in an HTTP request.

AFAIU does not address the question, so I turned to [2] which suggests that there can only be one Authorization header per request. Because Authorization does not have a list value format.

Is that interpretation correct?

I am wondering because I understand [1] to say that WWW-Authenticate can indeed be used multiple times. However, WWW-Authenticate also does not have a list value format but is also not listed as an exception in [2], as is Set-Cookie.

Can anyone clarify?

Jan

[1] http://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-22
[2] http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-22#section-3.2.2

Question on Multiplicity of Authorization and WWW… Jan Algermissen
Re: Question on Multiplicity of Authorization and… Julian Reschke
Re: Question on Multiplicity of Authorization and… Julian Reschke