Re: [hybi] Authentication headers

[Wellington Fernando de Macedo <[e-mail]>]

*> For example, the only authentication scheme that would work and be secure
is Basic auth
> over TLS to the same host as served the HTML page. In practice, only very
 > few sites use that combination of technologies; the cost of supporting it
> seems higher than the benefit gained from it.*

Well, where I last worked it used TLS+Basic Auth (using PAM). This is very
useful, sure :)
*
> There are also a number of situations where it
> would seem that it should work but where it won't*

If it is true, then http auth should be removed at all. The Mozilla's
implementation shares the ws
credentials with the http ones (using the origin). So it isn't a problem. I
think that removing
http auth should be horribly bad. Similarly I think denying websockets from
using it isn't a good
thing either.

*> Sure there are other ways than using headers, but the fact remains that
many implementations do use headers
> and I see no reason to break those implementation nor prevent their usage
with websocket.*

Actually I don't see any reasons to prevent these headers.

Regards,

Wellington.


2010/7/21 Greg Wilkins <[e-mail]>

>
>
> On 21 July 2010 17:01, Ian Hickson <[e-mail]> wrote:
>
>>  Cookies are supported because they are
>> _very_ widely used, so there's something to reuse. HTTP auth is used so
>> rarely that I'd seriously consider dropping it from HTTP at this point; I
>> really don't think it's worth adding to WebSockets.
>>
>
>
> HTTP headers are frequently used for authentication mechanisms that are
> neither the standard HTTP ones, nor plain simple cookies. For example many
> OAUTH implementations allow tokens to be negotiated using HTTP headers.
>
> Sure there are other ways than using headers, but the fact remains that
> many implementations do use headers and I see no reason to break those
> implementation nor prevent their usage with websocket.
>
>
>
>
>