Re: HTTP Unprompted Authentication

[Ben Schwartz <[e-mail]>]

I support the goals of the Unprompted Authentication draft.  In fact, I'm
so supportive that I recently posted a draft that happens to solve an
overlapping problem in a very different way: "Modernizing HTTP Forward
Proxy Functionality" [1].

To step back: confidential HTTP _resources_ are arguably a solved problem.
We can simply place the resource at an unguessable path (e.g. "capability
URLs" [2]).  The problem mentioned by this draft occurs when the HTTP
service is origin-scoped (e.g. it is not a resource).  The only
non-resource HTTP service that I'm aware of is forward proxy
functionality.  Thus, one way to improve confidentiality of proxies is to
make them path-scoped, and this is what the "Modernizing" draft does.

These proposals are not mutually exclusive.  Path-scoped proxies have other
benefits, and unprompted authentication could be useful for other services
with inflexible paths (e.g. .well-known/ resources).  However, given the
overlapping use cases, these drafts should probably be discussed together.

--Ben

[1]
https://datatracker.ietf.org/doc/draft-schwartz-modern-http-proxies/Modernizing
HTTP Forward Proxy Functionality
[2] https://www.w3.org/TR/capability-urls/