Re: [http-auth] Last Call: <draft-ietf-httpauth-basicauth-update-05.txt> (The 'Basic' HTTP Authentication Scheme) to Proposed Standard

[Alexey Melnikov <[e-mail]>]

Hi Bjoern,

On 05/02/2015 22:49, Bjoern Hoehrmann wrote:
  [snip]
>     The realm value is an opaque string
>     which can only be compared for equality with other realms on that
>     server.
>
> RFC 7235 says "The realm value is a string, generally assigned by the
> origin server, that can have additional semantics specific to the
> authentication scheme." This seems contradictory (perhaps the intent is
> to say that for the particular case of Basic, the realm value is opaque
> in contrast to other schemes where it might not be opaque, but that is
> not clear from the text) and misleading (users make decisions based on
> the string, which often contains human readable text, so it's not really
> opaque to them).
I think it is opaque to clients and servers, so they shouldn't try to 
parse it.
>     The original definition of this authentication scheme failed to
>     specify the character encoding scheme used to convert the user-pass
>     into an octet sequence.
>
> I think it would be more appropriate to say that it did not do so. That
> wasn't a particular "failure", sending unlabeled 8bit (and 7bit) content
> was normal at the time, in part because other system parts also did not
> know or care about character encodings.
I think the current text as specified is accurate, but I don't have a 
strong opinion.
> There should be an example for "no other authentication parameters are
> defined -- unknown parameters MUST be ignored by recipients", otherwise
> such extension points are too easily missed by implementers.