Re: [kitten] Stating support for HTTP-SASL on the HTTP WG list

[Simo Sorce <[e-mail]>]

On Fri, 2023-01-27 at 16:01 +0000, Rick van Rein wrote:
> Hi,
> 
> The HTTP WG is considering our embedding of SASL in HTTP.  I need
> IETF consensus to be permitted to say "Authorization: SASL", so
> to claim the "SASL" name.
> 
> They want to see some list traffic, to get an idea of interest in
> this mechanism.  If you have any such feelings, please tell them,
> because silence in the busy HTTP WG may cause it to be dropped.
> 
> While we implemented for Apache, Nginx and FireFox, I think this
> opens excellent opportunities for RESTful and other HTTP protocols.
> Would be useful to see those popup on that list.

I think allowing something like SASL in HTTP would finally liberate it
from the old Basic (or worse, digtest-md5) schemes with an elegant way
to "defer to a specialized framework", so I support this in principle.

*However* the main issue that plagues HTTP(s) when it comes to
authentication is the requirement to re-authenticate each request
because clients tend to create a new connection every time they want to
make a new request.

I would like to see a standardized mechanism to return a bearer token
(aka session cookie) that allows the client to retain (if they want) an
authorization token to be used in following requests.

The last thing we need is for people to invent their own caching
mechanisms to prevent browsers or other client from constantly
prompting for credentials on naive configurations.
The mechanism to deal with "sessions" should be built-in, not an
exercise left to the reader.

Simo.

-- 
Simo Sorce
RHEL Crypto Team
Red Hat, Inc