Re: [secdir] secdir review of draft-ietf-httpauth-basicauth-update-06

[Julian Reschke <[e-mail]>]

On 2015-02-18 23:18, Julian Reschke wrote:
> ...
>> Interaction with proxies?
>> -------------------------
>>
>> There is only a passing mention of Proxy-Authenticate: and
>> Proxy-Authorization: headers, so one assumes that both mechanisms should
>> support this new auth-param.  It's not clear to me whether there are any
>> additional security or privacy implications when this is addressed to
>> proxies compared to origin servers.
>
> I'm not aware of any.
>
>> Section 2.2 ("reusing credentials") talks about the URI path (presumably
>> for "WWW-Authenticate", but then mixes "Proxy-Authenticate" into the
>> middle of that commentary.  It looks to me like "Proxy-Authenticate" is
>> not intended to be scoped by the URI path (there is no mention of "in
>> that space" in the sentence about Proxy-Authenticate in Section 2.2),
>> but this is kind of ambiguous.  Clarification would be good.
>
> To be frank, I don't know. My best guess is that it works exactly the
> same, so I'll add "in that space" there as well.
> ...

I'll take that back. The current draft is in sync with what RFC 2617 
said. I'd rather not change that without understanding the implications.

>> User IDs with Colons
>> --------------------
>>
>> The draft says "a user-id containing a colon character is invalid" --
>> why not say that "the user-id MUST NOT contain a colon character", as it
>> already does for control characters?
>
> I don't think it really matters how we say it (both have exactly the
> same normative power), but I agree it would be better for consistency.

I changed my mind when I replied to Pete Resnick's mail: I really don't 
see the point of declaring something a "MUST NOT" when most UAs actually 
do it.

>> Nits
>> ====
>>
>>   * in B.3, "Authentication on these sites will stop to work" should be
>>     "Authentication on these sites will stop working"
>
> Ok.

So far, I have 
<http://trac.tools.ietf.org/wg/httpauth/trac/changeset/120> and 
<http://trac.tools.ietf.org/wg/httpauth/trac/changeset/121>.

Best regards, Julian