Re: [sipcore] draft-ietf-sipcore-digest-scheme comments

[Christer Holmberg <[e-mail]>]

Hi,
  
... 

>>>>> Section 2.4:
>>>>>
>>>>> "When the UAC receives a response with multiple header fields with the
>>>>>   same realm it SHOULD use the topmost header field that it supports,
>>>>>   unless a local policy dictates otherwise.”
>>>>>
>>>>> Why a SHOULD? I would prefer a MUST.
>>>>
>>>> I can do that, but the last part of this paragraph states that local policy can override this recommendations anyway.
>>>> So, does it make any difference?
>>>> Should we allow that? Why would local policy enforce a downgrade?
>>>>
>>>>> “When the UAC receives a 401 response with multiple WWW-Authenticate
>>>>>   header fields with different realms it SHOULD retry and include an
>>>>>   Authorization header field containing credentials that match the
>>>>>   topmost header field of any one of the realms.”
>>>>>
>>>>> If you are disallowing multiple Authorization headers for the same realm,
>>>>> but with different algorithms I think this should be clearly written. In my
>>>>> view, that would be a good thing.
>>>>
>>>> This is allowed.
>>>
>>> RFC 3261 does not say anything about using the topmost header, does it?
>>>
>>> I was referring to this document.
>>
>> So, the should-use-topmost is something new, defined in this document?
>
> Yes, as per RFC7616.

Perhaps then say "As defined in RFC7617,...."

And, perhaps mention it in section 2, where the changes are listed.

Also, as the remote peer may not have implemented the draft, I think it would be good to point out that one must not assume that the peer will use the topmost header, even if it supports the algorithm in the topmost header.

Regards,

Christer