Re: [secdir] Reuse of credentials per realm, was: SECDIR review of draft-ietf-httpbis-p7-auth-24

[Stephen Kent <[e-mail]>]

Julian,

Since, as you note, the server ultimately accepts or rejects the 
credentials,
it was not clear under what circumstances "user preferences" are a valid 
factor
in deciding when to stop using the same set of credentials. If you could 
elaborate
that would be useful.

Steve
> On 2013-10-29 20:35, Stephen Kent wrote:
>> ...
>> In Section 2.2 the text says:
>>
>> The protection space determines the domain over which credentials can
>>
>> be automatically applied.If a prior request has been authorized,
>>
>> the user agent MAY reuse the same credentials for all other requests
>>
>> within that protection space for a period of time determined by the
>>
>> authentication scheme, parameters, and/or user preference.
>>
>> I’m not clear how user preferences fit into this process. It would seem
>> that the server would decide whether a prior authorization is valid for
>> later requests, not a user.
>> ...
>
> Of course it's up to the server to accept or reject it. The text you 
> cite is about the user agent deciding whether it can try to use the 
> credentials.
>
> Does this require a clarification?
>
> Best regards, Julian
>