From jan.algermissen@nordsc.com Thu Mar 7 20:21:13 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E94AE21F86C5 for ; Thu, 7 Mar 2013 20:21:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.341 X-Spam-Level: X-Spam-Status: No, score=-0.341 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_ILLEGAL_IP=1.908] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iA50UGkrPbnI for ; Thu, 7 Mar 2013 20:21:13 -0800 (PST) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.17.8]) by ietfa.amsl.com (Postfix) with ESMTP id 3816721F8609 for ; Thu, 7 Mar 2013 20:21:13 -0800 (PST) Received: from [192.168.3.138] (80-39-145-5-pool.cable.fcom.ch [5.145.39.80]) by mrelayeu.kundenserver.de (node=mreu2) with ESMTP (Nemesis) id 0LuYaa-1Uvqno0k0e-010KbF; Fri, 08 Mar 2013 05:21:12 +0100 From: Jan Algermissen Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: <4D110514-6503-4265-998C-D70683D5E302@nordsc.com> Date: Fri, 8 Mar 2013 05:21:11 +0100 To: http-auth@ietf.org Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) X-Mailer: Apple Mail (2.1499) X-Provags-ID: V02:K0:tQxOWc2qKx0waJzcE3Xi/R4X0zHwR65x8UUNvkl5TxT JJ6ycV7MYP635vm/X1Qn82yndercatObHH/di923MdC/63aW4c InGyzWi1NMBwekbNK0WfL9jXEV5xOZU1vimflP42o6bFX1jRIm X7GH93gL6ydZONuTC2gvEUUYabWVBadehBV1lNSSuMdBJ4jCbj 1NiTzyJbGRmwxxwwmsR2n+q6wKQ6HrzxQ737AfGJTE0gT7JQsp zNP91DB9BBBiSdpF06Q+ribcZkLDv2T2aB0YSXqKbj977tBLe2 4wZQMOq0vdNUPrxAHhIuibcWxuDI5Qiy2F1tcj3b2mjZIK9t7l 5iqKiMRSuY8r0zVUY4PCa7dsutXDJsoyeEB59tjg+u9dWAQAu+ nbN3un5UeIxaA== Subject: [http-auth] 'Transmission'? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Mar 2013 04:21:14 -0000 All, regarding the charter[1] title, shouldn't that be "Hypertext Transfer = Protocol Authentication"? Or am I missing historical context here? Jan [1] https://datatracker.ietf.org/doc/charter-ietf-httpauth/= From mnot@mnot.net Thu Mar 7 23:41:48 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7E7D21F8609 for ; Thu, 7 Mar 2013 23:41:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fYfFEqnke95Z for ; Thu, 7 Mar 2013 23:41:48 -0800 (PST) Received: from mxout-08.mxes.net (mxout-08.mxes.net [216.86.168.183]) by ietfa.amsl.com (Postfix) with ESMTP id 11F2521F8605 for ; Thu, 7 Mar 2013 23:41:48 -0800 (PST) Received: from [10.0.251.33] (unknown [195.99.168.174]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by smtp.mxes.net (Postfix) with ESMTPSA id 2B781509B8; Fri, 8 Mar 2013 02:41:46 -0500 (EST) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Mark Nottingham In-Reply-To: <4D110514-6503-4265-998C-D70683D5E302@nordsc.com> Date: Fri, 8 Mar 2013 07:41:47 +0000 Content-Transfer-Encoding: quoted-printable Message-Id: References: <4D110514-6503-4265-998C-D70683D5E302@nordsc.com> To: Jan Algermissen X-Mailer: Apple Mail (2.1499) Cc: http-auth@ietf.org Subject: Re: [http-auth] 'Transmission'? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Mar 2013 07:41:48 -0000 Well, that doesn't bode well=85 On 08/03/2013, at 4:21 AM, Jan Algermissen = wrote: > All, >=20 > regarding the charter[1] title, shouldn't that be "Hypertext Transfer = Protocol Authentication"? >=20 > Or am I missing historical context here? >=20 > Jan >=20 > [1] https://datatracker.ietf.org/doc/charter-ietf-httpauth/ > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth -- Mark Nottingham http://www.mnot.net/ From ynir@checkpoint.com Fri Mar 8 00:14:08 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89C8321F85A1 for ; Fri, 8 Mar 2013 00:14:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.549 X-Spam-Level: X-Spam-Status: No, score=-10.549 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l-wKb3bOkm00 for ; Fri, 8 Mar 2013 00:14:04 -0800 (PST) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id 2906221F85DA for ; Fri, 8 Mar 2013 00:14:03 -0800 (PST) Received: from DAG-EX10.ad.checkpoint.com ([194.29.34.150]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id r288DsD0000631; Fri, 8 Mar 2013 10:13:54 +0200 X-CheckPoint: {51399D41-0-1B221DC2-2FFFF} Received: from IL-EX10.ad.checkpoint.com ([169.254.2.54]) by DAG-EX10.ad.checkpoint.com ([169.254.3.95]) with mapi id 14.02.0342.003; Fri, 8 Mar 2013 10:13:53 +0200 From: Yoav Nir To: Mark Nottingham Thread-Topic: [http-auth] 'Transmission'? Thread-Index: AQHOG7RmDCsQMh/CP0Gr32OZoDFRVZibR9aAgAAI+oA= Date: Fri, 8 Mar 2013 08:13:53 +0000 Message-ID: <775BA252-6434-4ACE-A82A-EEB61ABF63FB@checkpoint.com> References: <4D110514-6503-4265-998C-D70683D5E302@nordsc.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.31.21.125] x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean Content-Type: text/plain; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "" Subject: Re: [http-auth] 'Transmission'? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Mar 2013 08:14:08 -0000 2nd time I come across this mistake lately http://tools.ietf.org/id/draft-williams-websec-session-continue-prob-00.htm= l On Mar 8, 2013, at 9:41 AM, Mark Nottingham wrote: > Well, that doesn't bode well=85 >=20 >=20 > On 08/03/2013, at 4:21 AM, Jan Algermissen w= rote: >=20 >> All, >>=20 >> regarding the charter[1] title, shouldn't that be "Hypertext Transfer Pr= otocol Authentication"? >>=20 >> Or am I missing historical context here? >>=20 >> Jan >>=20 >> [1] https://datatracker.ietf.org/doc/charter-ietf-httpauth/ >> _______________________________________________ >> http-auth mailing list >> http-auth@ietf.org >> https://www.ietf.org/mailman/listinfo/http-auth >=20 > -- > Mark Nottingham http://www.mnot.net/ >=20 >=20 >=20 > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth >=20 > Email secured by Check Point From julian.reschke@gmx.de Tue Mar 12 06:34:08 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18DD321F8B6D for ; Tue, 12 Mar 2013 06:34:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.662 X-Spam-Level: X-Spam-Status: No, score=-106.662 tagged_above=-999 required=5 tests=[AWL=-3.062, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zs9PNKq57Y1l for ; Tue, 12 Mar 2013 06:34:07 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.15]) by ietfa.amsl.com (Postfix) with ESMTP id 1E53021F8A91 for ; Tue, 12 Mar 2013 06:34:07 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.4]) by mrigmx.server.lan (mrigmx001) with ESMTP (Nemesis) id 0MKOgi-1UDke81mx4-001eUI for ; Tue, 12 Mar 2013 14:34:06 +0100 Received: (qmail invoked by alias); 12 Mar 2013 13:34:06 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.105]) [217.91.35.233] by mail.gmx.net (mp004) with SMTP; 12 Mar 2013 14:34:06 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX1+lKd0XhYelWSRm5L1EyfyXU2xhJCVJDf7n1SmwH2 kIf5yWyJerq7d2 Message-ID: <513F2ECC.1050609@gmx.de> Date: Tue, 12 Mar 2013 14:34:04 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130215 Thunderbird/17.0.3 MIME-Version: 1.0 To: http-auth@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Subject: [http-auth] IETF 86 - no meeting agenda for httpauth? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 13:34:08 -0000 (see subject line) From sm@resistor.net Tue Mar 12 06:59:12 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB54F21F86AD for ; Tue, 12 Mar 2013 06:59:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9JsseY-CuWeY for ; Tue, 12 Mar 2013 06:59:12 -0700 (PDT) Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B38221F869C for ; Tue, 12 Mar 2013 06:59:12 -0700 (PDT) Received: from sm-THINK.resistor.net (IDENT:sm@localhost [127.0.0.1]) (authenticated bits=0) by mx.elandsys.com (8.14.5/8.14.5) with ESMTP id r2CDx5jc011385; Tue, 12 Mar 2013 06:59:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1363096748; bh=Fl/6yp2vJQcICN7jPSmdz1f0NMeU8evFXDY7QGXbcaA=; h=Date:To:From:Subject:Cc:In-Reply-To:References; b=eYzAaUNcoYL3Pow8YGBv4aAwIXiDKzBflRnq+It9DfpEHrfowdfyq9wuqawj+dvuB P/5JiIEg5xvPaOcHUwYsFCsq8wjupT31b1JL2BrgF5oNfAMG9b1+W0BwonTCfwsq0u +94MI/udg0v6HF0wnPDb78NPCIUv9Uq1BIr7ITPE= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1363096748; i=@resistor.net; bh=Fl/6yp2vJQcICN7jPSmdz1f0NMeU8evFXDY7QGXbcaA=; h=Date:To:From:Subject:Cc:In-Reply-To:References; b=NILyQwQY0oDqAEFhLZVcO+cNEXElWa5JqPJxWGA8ksZyKs2AW9qb5zeLTIpmYFExc zUOZwfq4vVN1H07/SRcxPdtYE2dcPhzzKxOkAAIPJIS7GzS1h6ufZ1nQYOERmct+mK zqdXyPfHL9bowy0+6yU4y7EgvRUC8xKUL++yQQhQ= Message-Id: <6.2.5.6.2.20130312065600.0704c938@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Tue, 12 Mar 2013 06:58:13 -0700 To: Julian Reschke From: SM In-Reply-To: <513F2ECC.1050609@gmx.de> References: <513F2ECC.1050609@gmx.de> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Cc: http-auth@ietf.org, sec-ads@tools.ietf.org Subject: Re: [http-auth] IETF 86 - no meeting agenda for httpauth? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 13:59:13 -0000 Hi Julian, I don't see any agenda. I'll copy the message to the ADs as they usual fix stuff like this. :-) Regards, -sm From ynir@checkpoint.com Tue Mar 12 07:05:33 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB3DF21F8A5F for ; Tue, 12 Mar 2013 07:05:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.569 X-Spam-Level: X-Spam-Status: No, score=-10.569 tagged_above=-999 required=5 tests=[AWL=0.030, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gb3BURs69mSZ for ; Tue, 12 Mar 2013 07:05:27 -0700 (PDT) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id 9558B21F8675 for ; Tue, 12 Mar 2013 07:05:26 -0700 (PDT) Received: from DAG-EX10.ad.checkpoint.com ([194.29.34.150]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id r2CE5LFq016403; Tue, 12 Mar 2013 16:05:21 +0200 X-CheckPoint: {513F3562-0-1B221DC2-2FFFF} Received: from IL-EX10.ad.checkpoint.com ([169.254.2.54]) by DAG-EX10.ad.checkpoint.com ([169.254.3.95]) with mapi id 14.02.0342.003; Tue, 12 Mar 2013 16:05:21 +0200 From: Yoav Nir To: SM Thread-Topic: [http-auth] IETF 86 - no meeting agenda for httpauth? Thread-Index: AQHOHyZKL2olAqO7dkyZwWhL4J3eL5ih83KAgAAB/QA= Date: Tue, 12 Mar 2013 14:05:20 +0000 Message-ID: References: <513F2ECC.1050609@gmx.de> <6.2.5.6.2.20130312065600.0704c938@resistor.net> In-Reply-To: <6.2.5.6.2.20130312065600.0704c938@resistor.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.31.20.25] x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean Content-Type: text/plain; charset="us-ascii" Content-ID: <2E13B3294D322140B6CEE47785E7A052@ad.checkpoint.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: Julian Reschke , "" , "" Subject: Re: [http-auth] IETF 86 - no meeting agenda for httpauth? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 14:05:33 -0000 Sorry about that. Already fixed. We were waiting to see if we actually have a working group, = but I guess it's better to have an agenda up. Sorry, no slides ready yet. Yoav On Mar 12, 2013, at 9:58 AM, SM wrote: > Hi Julian, >=20 > I don't see any agenda. I'll copy the message to the ADs as they usual f= ix stuff like this. :-) >=20 > Regards, > -sm >=20 > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth >=20 > Email secured by Check Point From turners@ieca.com Tue Mar 12 07:05:34 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3174B21F88D6 for ; Tue, 12 Mar 2013 07:05:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.23 X-Spam-Level: X-Spam-Status: No, score=-102.23 tagged_above=-999 required=5 tests=[AWL=0.035, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RdAqZHA4yDnJ for ; Tue, 12 Mar 2013 07:05:33 -0700 (PDT) Received: from gateway03.websitewelcome.com (gateway03.websitewelcome.com [69.93.38.21]) by ietfa.amsl.com (Postfix) with ESMTP id C08CD21F8A74 for ; Tue, 12 Mar 2013 07:05:31 -0700 (PDT) Received: by gateway03.websitewelcome.com (Postfix, from userid 5007) id ECB1239C51460; Tue, 12 Mar 2013 09:05:29 -0500 (CDT) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway03.websitewelcome.com (Postfix) with ESMTP id B40FE39C5131E for ; Tue, 12 Mar 2013 09:05:29 -0500 (CDT) Received: from [198.180.150.142] (port=51934 helo=dhcp-5422.meeting.ietf.org) by gator1743.hostgator.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1UFPpY-0003bn-5v; Tue, 12 Mar 2013 09:05:28 -0500 Message-ID: <513F3627.3040305@ieca.com> Date: Tue, 12 Mar 2013 10:05:27 -0400 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: SM , Julian Reschke References: <513F2ECC.1050609@gmx.de> <6.2.5.6.2.20130312065600.0704c938@resistor.net> In-Reply-To: <6.2.5.6.2.20130312065600.0704c938@resistor.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (dhcp-5422.meeting.ietf.org) [198.180.150.142]:51934 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 6 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Cc: http-auth@ietf.org, sec-ads@tools.ietf.org Subject: Re: [http-auth] IETF 86 - no meeting agenda for httpauth? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 14:05:34 -0000 So this is entirely my fault. I wanted to ensure the WG was chartered before the session and I had to find chairs. Something should be up before the session. I think the session is probably going to spend most of it's time determining the ground rules for progressing the experimental drafts. spt On 3/12/13 9:58 AM, SM wrote: > Hi Julian, > > I don't see any agenda. I'll copy the message to the ADs as they usual > fix stuff like this. :-) > > Regards, > -sm > > From turners@ieca.com Tue Mar 12 07:14:01 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0415D11E809C for ; Tue, 12 Mar 2013 07:14:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.235 X-Spam-Level: X-Spam-Status: No, score=-102.235 tagged_above=-999 required=5 tests=[AWL=0.030, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 52u+kaJfsuY7 for ; Tue, 12 Mar 2013 07:13:59 -0700 (PDT) Received: from gateway05.websitewelcome.com (gateway05.websitewelcome.com [67.18.44.15]) by ietfa.amsl.com (Postfix) with ESMTP id 3A76A21F8B15 for ; Tue, 12 Mar 2013 07:13:53 -0700 (PDT) Received: by gateway05.websitewelcome.com (Postfix, from userid 5007) id C9F3FAC421529; Tue, 12 Mar 2013 09:13:52 -0500 (CDT) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway05.websitewelcome.com (Postfix) with ESMTP id ACB3AAC421480 for ; Tue, 12 Mar 2013 09:13:52 -0500 (CDT) Received: from [198.180.150.142] (port=51952 helo=dhcp-5422.meeting.ietf.org) by gator1743.hostgator.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1UFPxg-0000ER-GK for http-auth@ietf.org; Tue, 12 Mar 2013 09:13:52 -0500 Message-ID: <513F381F.306@ieca.com> Date: Tue, 12 Mar 2013 10:13:51 -0400 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: http-auth@ietf.org References: <513F2ECC.1050609@gmx.de> <6.2.5.6.2.20130312065600.0704c938@resistor.net> <513F3627.3040305@ieca.com> In-Reply-To: <513F3627.3040305@ieca.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (dhcp-5422.meeting.ietf.org) [198.180.150.142]:51952 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 13 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Subject: Re: [http-auth] IETF 86 - no meeting agenda for httpauth? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 14:14:01 -0000 Oh and just in case it wasn't clear: the WG was approved. You should see an announcement before the session. spt On 3/12/13 10:05 AM, Sean Turner wrote: > So this is entirely my fault. I wanted to ensure the WG was chartered > before the session and I had to find chairs. > > Something should be up before the session. I think the session is > probably going to spend most of it's time determining the ground rules > for progressing the experimental drafts. > > spt > > On 3/12/13 9:58 AM, SM wrote: >> Hi Julian, >> >> I don't see any agenda. I'll copy the message to the ADs as they usual >> fix stuff like this. :-) >> >> Regards, >> -sm >> >> > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth > From iesg-secretary@ietf.org Tue Mar 12 07:40:51 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8847321F8BEA; Tue, 12 Mar 2013 07:40:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.557 X-Spam-Level: X-Spam-Status: No, score=-102.557 tagged_above=-999 required=5 tests=[AWL=0.043, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hrckeU2UryJS; Tue, 12 Mar 2013 07:40:50 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4536A21F8BED; Tue, 12 Mar 2013 07:40:50 -0700 (PDT) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: IETF-Announce X-Test-IDTracker: no X-IETF-IDTracker: 4.42 Message-ID: <20130312144050.12652.89148.idtracker@ietfa.amsl.com> Date: Tue, 12 Mar 2013 07:40:50 -0700 X-Mailman-Approved-At: Tue, 12 Mar 2013 07:41:56 -0700 Cc: httpauth WG Subject: [http-auth] WG Action: Formed Hypertext Transmission Protocol Authentication (httpauth) X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 14:40:51 -0000 A new IETF working group has been formed in the Security Area. For additional information please contact the Area Directors or the WG Chairs. Hypertext Transmission Protocol Authentication (httpauth) ------------------------------------------------ Current Status: Proposed Working Group Chairs: Matt Lepinski Yoav Nir Assigned Area Director: Sean Turner Mailing list Address: http-auth@ietf.org To Subscribe: https://www.ietf.org/mailman/listinfo/http-auth Archive: http://www.ietf.org/mail-archive/web/http-auth/ Charter of Working Group: Authentication of users to servers over HTTP has always been a weak point in web services. The current HTTP authentication mechanisms, basic and digest, pass the credentials in the clear or employ weak algorithms and are considered to be insecure today. Authentication through non-standard web forms is much more commonly used, but also pass the credentials in the clear. There is a need for improved mechanisms that can replace or augment HTTP authentication without the need to rely on transport layer security. Only HTTP authentication is in scope for this WG; form-based or "web" authentication is out of scope. The httpauth WG will be a short-lived working group that will document a small number of HTTP user authentication schemes that might offer security benefits, and that could, following experimentation, be widely adopted as standards-track schemes for HTTP user authentication. Each of these RFCs will be Informational or Experimental, and should include a description of when use of its mechanism is appropriate, via a use-case or other distinguishing characteristics. Standards track solutions for HTTP Authentication schemes are out of scope, as none of the proposals are expected to be sufficiently widely deployed to warrant that status before the WG closes. All schemes to be developed in the httpauth WG must be usable with the existing HTTP authentication framework, or with evolutions of that framework as developed in the httpbis WG. That is, the evolution of the HTTP authentication framework is to be done in the httpbis WG and not in the httpauth WG. The httpauth WG will work closely with the httpbis WG to ensure that the outcomes from the httpauth WG do not conflict with work done elsewhere. The drafts currently under consideration as WG items include: - draft-williams-http-rest-auth - draft-oiwa-http-mutualauth and draft-oiwa-http-auth-extension - draft-farrell-httpbis-hoba - draft-montenegro-httpbis-multilegged-auth - draft-melnikov-httpbis-scram-auth The WG will produce two standards track documents that will obsolete the basic and digest schemes defined in RFC 2617 taking into account errata on that specification. For the digest scheme, the new specification will incorporate "more modern" algorithm agility and internationalization support, which requires input from internationalization experts. draft-ahrens-httpbis-digest-auth-update documents one possible approach that the WG could adopt and modify as it sees fit. For the basic scheme, no technical changes are envisaged other than to handle internationalization of usernames and passwords. The goal is to improve the scheme's documentation and to obsolete RFC 2617, which has some significant flaws that have emerged through 13 years of experience. The WG is not required to merge all proposals into one. The goal is not to produce "perfect" mechanisms, but to review and improve proposals and to quickly produce stable specifications for the purpose of obtaining implementation and deployment experience. The working group will then close, and any further culling or refinement of the experimental mechanisms will be done in another context. It is expected that the market/community will select which if any of the RFCs developed might be worth progressing on the standards-track at a later date, in a different WG. Adoption of additional work items is not expected and will require a re-charter. The following are explicitly out of scope: - changes to TLS - changes to HTTP, except for those made in the httpbis WG - definition of authentication mechanisms that do not work with the HTTP authentication framework - authentication schemes that distinguish between devices and humans - authentication schemes that cannot be sensibly used for and by humans - "web" authentication that is not HTTP authentication Milestones: TBD From iesg-secretary@ietf.org Tue Mar 12 07:59:48 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6325621F85ED; Tue, 12 Mar 2013 07:59:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.557 X-Spam-Level: X-Spam-Status: No, score=-102.557 tagged_above=-999 required=5 tests=[AWL=0.043, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MjNPvGs+IUpu; Tue, 12 Mar 2013 07:59:47 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F13B21F858B; Tue, 12 Mar 2013 07:59:47 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: IESG Secretary To: IETF Announcement List X-Test-IDTracker: no X-IETF-IDTracker: 4.42 Message-ID: <20130312145947.11850.97893.idtracker@ietfa.amsl.com> Date: Tue, 12 Mar 2013 07:59:47 -0700 Cc: httpauth WG Subject: [http-auth] REVISED WG Action: Formed Hypertext Transfer Protocol Authentication (httpauth) X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 14:59:48 -0000 A new IETF working group has been formed in the Security Area. For additional information please contact the Area Directors or the WG Chairs. Hypertext Transfer Protocol Authentication (httpauth) ------------------------------------------------ Current Status: Proposed Working Group Chairs: Matt Lepinski Yoav Nir Assigned Area Director: Sean Turner Mailing list Address: http-auth@ietf.org To Subscribe: https://www.ietf.org/mailman/listinfo/http-auth Archive: http://www.ietf.org/mail-archive/web/http-auth/ Charter of Working Group: Authentication of users to servers over HTTP has always been a weak point in web services. The current HTTP authentication mechanisms, basic and digest, pass the credentials in the clear or employ weak algorithms and are considered to be insecure today. Authentication through non-standard web forms is much more commonly used, but also pass the credentials in the clear. There is a need for improved mechanisms that can replace or augment HTTP authentication without the need to rely on transport layer security. Only HTTP authentication is in scope for this WG; form-based or "web" authentication is out of scope. = The httpauth WG will be a short-lived working group that will document a small number of HTTP user authentication schemes that might offer security benefits, and that could, following experimentation, be widely adopted as standards-track schemes for HTTP user authentication. Each of these RFCs will be Informational or Experimental, and should include a description of when use of its mechanism is appropriate, via a use-case or other distinguishing characteristics. Standards track solutions for HTTP Authentication schemes are out of scope, as none of the proposals are expected to be sufficiently widely deployed to warrant that status before the WG closes. = All schemes to be developed in the httpauth WG must be usable with the existing HTTP authentication framework, or with evolutions of that framework as developed in the httpbis WG. That is, the evolution of the HTTP authentication framework is to be done in the httpbis WG and not in the httpauth WG. The httpauth WG will work closely with the httpbis WG to ensure that the outcomes from the httpauth WG do not conflict with work done elsewhere. The drafts currently under consideration as WG items include: - draft-williams-http-rest-auth - draft-oiwa-http-mutualauth and draft-oiwa-http-auth-extension - draft-farrell-httpbis-hoba - draft-montenegro-httpbis-multilegged-auth - draft-melnikov-httpbis-scram-auth The WG will produce two standards track documents that will obsolete the basic and digest schemes defined in RFC 2617 taking into account errata on that specification. = For the digest scheme, the new specification will incorporate "more modern" algorithm agility and internationalization support, which requires input from internationalization experts. draft-ahrens-httpbis-digest-auth-update documents one possible approach that the WG could adopt and modify as it sees fit. For the basic scheme, no technical changes are envisaged other than to handle internationalization of usernames and passwords. The goal is to improve the scheme's documentation and to obsolete RFC 2617, which has some significant flaws that have emerged through 13 years of experience. The WG is not required to merge all proposals into one. The goal is not to produce "perfect" mechanisms, but to review and improve proposals and to quickly produce stable specifications for the purpose of obtaining implementation and deployment experience. The working group will then close, and any further culling or refinement of the experimental mechanisms will be done in another context. It is expected that the market/community will select which if any of the RFCs developed might be worth progressing on the standards-track at a later date, in a different WG. Adoption of additional work items is not expected and will require a re-charter. The following are explicitly out of scope: - changes to TLS - changes to HTTP, except for those made in the httpbis WG - definition of authentication mechanisms that do not work with the HTTP authentication framework - authentication schemes that distinguish between devices and humans - authentication schemes that cannot be sensibly used for and by humans - "web" authentication that is not HTTP authentication Milestones: TBD From ynir@checkpoint.com Tue Mar 12 09:09:30 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB37621F8B16 for ; Tue, 12 Mar 2013 09:09:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.576 X-Spam-Level: X-Spam-Status: No, score=-10.576 tagged_above=-999 required=5 tests=[AWL=0.023, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pExdfrjpy-FE for ; Tue, 12 Mar 2013 09:09:30 -0700 (PDT) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id 0A3DE21F8AB2 for ; Tue, 12 Mar 2013 09:09:29 -0700 (PDT) Received: from DAG-EX10.ad.checkpoint.com ([194.29.34.150]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id r2CG9SQT018176 for ; Tue, 12 Mar 2013 18:09:28 +0200 X-CheckPoint: {513F5277-3-1B221DC2-2FFFF} Received: from IL-EX10.ad.checkpoint.com ([169.254.2.54]) by DAG-EX10.ad.checkpoint.com ([169.254.3.95]) with mapi id 14.02.0342.003; Tue, 12 Mar 2013 18:09:28 +0200 From: Yoav Nir To: "http-auth@ietf.org" Thread-Topic: [http-auth] IETF 86 - no meeting agenda for httpauth? Thread-Index: AQHOHyZKL2olAqO7dkyZwWhL4J3eL5ih83KAgAAB/QCAACKsAA== Date: Tue, 12 Mar 2013 16:09:27 +0000 Message-ID: <2C27DCCC-603A-4602-ADC5-35585347538D@checkpoint.com> References: <513F2ECC.1050609@gmx.de> <6.2.5.6.2.20130312065600.0704c938@resistor.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.31.20.25] x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [http-auth] IETF 86 - no meeting agenda for httpauth? X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 16:09:30 -0000 Slides are up now. On Mar 12, 2013, at 10:05 AM, Yoav Nir wrote: > Sorry about that. >=20 > Already fixed. We were waiting to see if we actually have a working group= , but I guess it's better to have an agenda up. >=20 > Sorry, no slides ready yet. >=20 > Yoav >=20 From julian.reschke@gmx.de Wed Mar 13 05:49:55 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 987B621F8928 for ; Wed, 13 Mar 2013 05:49:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.549 X-Spam-Level: X-Spam-Status: No, score=-105.549 tagged_above=-999 required=5 tests=[AWL=-2.950, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mjpe9k+3BEwu for ; Wed, 13 Mar 2013 05:49:55 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) by ietfa.amsl.com (Postfix) with ESMTP id 9FF7921F898A for ; Wed, 13 Mar 2013 05:49:54 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.17]) by mrigmx.server.lan (mrigmx002) with ESMTP (Nemesis) id 0LpAXC-1UuZWP3OYG-00esoV for ; Wed, 13 Mar 2013 13:49:53 +0100 Received: (qmail invoked by alias); 13 Mar 2013 12:49:53 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.105]) [217.91.35.233] by mail.gmx.net (mp017) with SMTP; 13 Mar 2013 13:49:53 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX1/hBntcRIfhhr/ylb2x37bZB17JUevq1bwB8tN9nZ W/TF6k3bybb6Y/ Message-ID: <514075EE.4090300@gmx.de> Date: Wed, 13 Mar 2013 13:49:50 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: http-auth@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Subject: [http-auth] improving HTTP authentication in user agents X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2013 12:49:55 -0000 Hi there, no matter whether we tune/extend existing schemes, or try to deploy new schemes, we will have to consider limitations in existing user agents with respect to how WWW-Authenticate response header fields are parsed. See test cases at: *All* of the major browsers get some of these tests wrong (*). In the case of Firefox, it's because it doesn't have a *parser* for WWW-Authenticate; it just does a sub-string lookup. So, please: - review test cases, - contribute new test cases, - try to get some of the UAs fixed (at least Chromium and FF are Open Source...). Best regards, Julian (*) Konqueror isn't a "major" browser, but it *does* get things right. From julian.reschke@gmx.de Wed Mar 13 08:03:42 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B0A021F8E59 for ; Wed, 13 Mar 2013 08:03:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.281 X-Spam-Level: X-Spam-Status: No, score=-105.281 tagged_above=-999 required=5 tests=[AWL=-2.682, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xxrIXVhZo1d2 for ; Wed, 13 Mar 2013 08:03:41 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) by ietfa.amsl.com (Postfix) with ESMTP id 1D0B521F8E57 for ; Wed, 13 Mar 2013 08:03:41 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.33]) by mrigmx.server.lan (mrigmx002) with ESMTP (Nemesis) id 0LoKed-1Uvibt05tp-00gFia for ; Wed, 13 Mar 2013 16:03:40 +0100 Received: (qmail invoked by alias); 13 Mar 2013 15:03:39 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.105]) [217.91.35.233] by mail.gmx.net (mp033) with SMTP; 13 Mar 2013 16:03:39 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX1/veOIP5snv7MJDpIYAyEBbGj7KfNy2/8diFuGnbj X27GEPhm7XMQ3r Message-ID: <51409549.7090605@gmx.de> Date: Wed, 13 Mar 2013 16:03:37 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: http-auth@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Subject: [http-auth] Revising the "Basic" parts of RFC 2617 X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2013 15:03:42 -0000 Hi there, the above is in our charter, and I totally support that goal. Apart from extracting the text into a standalone document that references HTTPbis-Part7, the following things should be done: 1) Rephrase the security considerations (for instance, with respect to "Basic" over https). 2) *Explain* the I18N issue. 3) Update references where needed. 4) Resolve errata (the one I'm aware of -- -- will be gone once we update the document to reference HTTPbis). The charter also asks for 5) *fixing* the I18N issue. That's non-trivial; see . That draft has a *proposal* for fixing the issue, but it's unimplemented. I do not believe we can claim it solves the I18N issue unless we can show that it works in practice (two servers, to UAs). As such I would propose to: a) Just do 1)..4) b) Publish something like as Experimental c) Revisit the issue once we see implementations of b) Best regards, Julian From derhoermi@gmx.net Wed Mar 13 10:57:05 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FF1321F8E28 for ; Wed, 13 Mar 2013 10:57:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.505 X-Spam-Level: X-Spam-Status: No, score=-3.505 tagged_above=-999 required=5 tests=[AWL=-0.906, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fript+n9y-Qc for ; Wed, 13 Mar 2013 10:57:04 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) by ietfa.amsl.com (Postfix) with ESMTP id C378D21F8E16 for ; Wed, 13 Mar 2013 10:57:03 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.24]) by mrigmx.server.lan (mrigmx002) with ESMTP (Nemesis) id 0Ldb0m-1UyDHR09Z4-00ihci for ; Wed, 13 Mar 2013 18:57:03 +0100 Received: (qmail invoked by alias); 13 Mar 2013 17:57:02 -0000 Received: from p5B2339A1.dip.t-dialin.net (EHLO netb.fritz.box) [91.35.57.161] by mail.gmx.net (mp024) with SMTP; 13 Mar 2013 18:57:02 +0100 X-Authenticated: #723575 X-Provags-ID: V01U2FsdGVkX197HjloJTl7Yq8Z7tGjNdSmm347rtXIt/zH//aBG5 4rfVM3BozNikqu From: Bjoern Hoehrmann To: Julian Reschke Date: Wed, 13 Mar 2013 18:57:05 +0100 Message-ID: References: <514075EE.4090300@gmx.de> In-Reply-To: <514075EE.4090300@gmx.de> X-Mailer: Forte Agent 3.3/32.846 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Y-GMX-Trusted: 0 Cc: http-auth@ietf.org Subject: Re: [http-auth] improving HTTP authentication in user agents X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2013 17:57:05 -0000 * Julian Reschke wrote: >See test cases at: >So, please: > >- review test cases, > >- contribute new test cases, Single quotes, unclosed quote marks, \-escapes outside quotes, line ending with \, case-sensitivity like BASIC, repeated realm parameter with difference in case, multiple headers, particularily combined with some of the other ideas, say WWW-Authenticate: Basic, realm="foo WWW-Authenticate: bar" extension parameter before 'realm' (oh, you have that already), would come to mind what does not seem covered by your tests already. -- Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de 25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ From tim-research@sentinelchicken.org Wed Mar 13 11:05:20 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BB2321F8DF9 for ; Wed, 13 Mar 2013 11:05:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ZbTHSguonad for ; Wed, 13 Mar 2013 11:05:19 -0700 (PDT) Received: from sentinelchicken.org (laim.sentinelchicken.org [96.126.98.9]) by ietfa.amsl.com (Postfix) with SMTP id 9FECE21F8A0C for ; Wed, 13 Mar 2013 11:05:19 -0700 (PDT) Received: (qmail 5325 invoked from network); 13 Mar 2013 18:05:19 -0000 Received: from unknown (HELO pascal.sentinelchicken.org) (10.81.64.2) by lelantos.sentinelchicken.org with SMTP; 13 Mar 2013 18:05:19 -0000 Received: (qmail 26287 invoked by uid 1000); 13 Mar 2013 18:37:17 -0000 Date: Wed, 13 Mar 2013 11:37:17 -0700 From: Tim To: Julian Reschke Message-ID: <20130313183717.GX4080@sentinelchicken.org> References: <514075EE.4090300@gmx.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <514075EE.4090300@gmx.de> User-Agent: Mutt/1.5.20 (2009-06-14) Cc: http-auth@ietf.org Subject: Re: [http-auth] improving HTTP authentication in user agents X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2013 18:05:20 -0000 > - contribute new test cases, What about header continuations? eg: WWW-Authenticate: Basic realm="foo" Also, I believe I've seen application servers decode things like %22 in quoted header fields before. I'm guessing this is incorrect behavior. So this might be a useful test: WWW-Authenticate: Basic realm="foo%22" Not sure how interesting these are, but first that came to mind. tim From nico@cryptonector.com Wed Mar 13 15:34:05 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E93A21F85C0 for ; Wed, 13 Mar 2013 15:34:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.977 X-Spam-Level: X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jIvjPXv-FQ1C for ; Wed, 13 Mar 2013 15:34:05 -0700 (PDT) Received: from homiemail-a36.g.dreamhost.com (caiajhbdcagg.dreamhost.com [208.97.132.66]) by ietfa.amsl.com (Postfix) with ESMTP id D7E6221F8B20 for ; Wed, 13 Mar 2013 15:34:04 -0700 (PDT) Received: from homiemail-a36.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a36.g.dreamhost.com (Postfix) with ESMTP id 037D677801F for ; Wed, 13 Mar 2013 15:34:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h= mime-version:in-reply-to:references:date:message-id:subject:from :to:cc:content-type; s=cryptonector.com; bh=wp75uVsyBCRDrP8kxtGU Abam6Fw=; b=kO5MLt3MRuChdz2RFrW728yaizcmDlA4h5SdKnkozXy6qBPTY0Bi xbdk8We9OqiOWhHUIJXflnvlJrTAyeS27DuwZ3CIkkTXiboiudrjkg3NOoNwLp94 ahEHdfmXEJIh6/+xVzCxPhtUnzSzV4EpGbulpe7qsPV6+LAd5OW0kLc= Received: from mail-we0-f180.google.com (mail-we0-f180.google.com [74.125.82.180]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by homiemail-a36.g.dreamhost.com (Postfix) with ESMTPSA id 47E85778057 for ; Wed, 13 Mar 2013 15:34:03 -0700 (PDT) Received: by mail-we0-f180.google.com with SMTP id k14so1495240wer.39 for ; Wed, 13 Mar 2013 15:34:01 -0700 (PDT) MIME-Version: 1.0 X-Received: by 10.194.63.109 with SMTP id f13mr169091wjs.11.1363214041476; Wed, 13 Mar 2013 15:34:01 -0700 (PDT) Received: by 10.216.148.193 with HTTP; Wed, 13 Mar 2013 15:34:01 -0700 (PDT) In-Reply-To: <51409549.7090605@gmx.de> References: <51409549.7090605@gmx.de> Date: Wed, 13 Mar 2013 17:34:01 -0500 Message-ID: From: Nico Williams To: Julian Reschke Content-Type: text/plain; charset=UTF-8 Cc: http-auth@ietf.org Subject: Re: [http-auth] Revising the "Basic" parts of RFC 2617 X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2013 22:34:05 -0000 On Wed, Mar 13, 2013 at 10:03 AM, Julian Reschke wrote: > The charter also asks for > > 5) *fixing* the I18N issue. > > That's non-trivial; see > . > That draft has a *proposal* for fixing the issue, but it's unimplemented. I > do not believe we can claim it solves the I18N issue unless we can show that > it works in practice (two servers, to UAs). > > As such I would propose to: > > a) Just do 1)..4) > > b) Publish something like > as > Experimental IU support this, though I wouldn't stop at Experimental. This one seems safe enough to go straight to the Standards Track. Nico -- From julian.reschke@gmx.de Thu Mar 14 07:05:21 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2045011E8125 for ; Thu, 14 Mar 2013 07:05:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id duPSKfr+cqjQ for ; Thu, 14 Mar 2013 07:05:17 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) by ietfa.amsl.com (Postfix) with ESMTP id BC24311E8140 for ; Thu, 14 Mar 2013 07:05:12 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.2]) by mrigmx.server.lan (mrigmx001) with ESMTP (Nemesis) id 0Ljfl8-1UrOPP3vJY-00bZoB for ; Thu, 14 Mar 2013 15:05:12 +0100 Received: (qmail invoked by alias); 14 Mar 2013 14:05:11 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.105]) [217.91.35.233] by mail.gmx.net (mp002) with SMTP; 14 Mar 2013 15:05:11 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX186Dox/Iok69qKFcyNmQwPfJWA3bHEgithtE694Pl 5jwtiWTgguhCaP Message-ID: <5141D913.1000607@gmx.de> Date: Thu, 14 Mar 2013 15:05:07 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Tim References: <514075EE.4090300@gmx.de> <20130313183717.GX4080@sentinelchicken.org> In-Reply-To: <20130313183717.GX4080@sentinelchicken.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Cc: http-auth@ietf.org Subject: Re: [http-auth] improving HTTP authentication in user agents X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 14:05:21 -0000 On 2013-03-13 19:37, Tim wrote: >> - contribute new test cases, > > What about header continuations? eg: > > WWW-Authenticate: Basic > realm="foo" Unfortunately, this is something my test setup (httpd with mod_asis) won't generate. That being said: I'm mainly interested in *valid* responses (we should achieve interop on valid header fields before even starting to worry about invalid ones. (See ). > Also, I believe I've seen application servers decode things like %22 > in quoted header fields before. I'm guessing this is incorrect > behavior. So this might be a useful test: > > WWW-Authenticate: Basic realm="foo%22" Added as ; apparently the browsers are sane with respect to this. Best regards, Julian From julian.reschke@gmx.de Thu Mar 14 08:11:53 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44EE311E8289 for ; Thu, 14 Mar 2013 08:11:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.099 X-Spam-Level: X-Spam-Status: No, score=-103.099 tagged_above=-999 required=5 tests=[AWL=0.500, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id odnehwvWZ8vi for ; Thu, 14 Mar 2013 08:11:49 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.15]) by ietfa.amsl.com (Postfix) with ESMTP id BF3FC11E827B for ; Thu, 14 Mar 2013 08:11:48 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.28]) by mrigmx.server.lan (mrigmx002) with ESMTP (Nemesis) id 0MQsi0-1UB6QH22xi-00UL24 for ; Thu, 14 Mar 2013 16:11:47 +0100 Received: (qmail invoked by alias); 14 Mar 2013 15:11:47 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.105]) [217.91.35.233] by mail.gmx.net (mp028) with SMTP; 14 Mar 2013 16:11:47 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX1/omIQ2biLooK//NgIThyiTVplG8VW/H4aiwRJURi nCNw2atKPUyCwL Message-ID: <5141E8AE.9080905@gmx.de> Date: Thu, 14 Mar 2013 16:11:42 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Bjoern Hoehrmann References: <514075EE.4090300@gmx.de> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Cc: http-auth@ietf.org Subject: Re: [http-auth] improving HTTP authentication in user agents X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 15:11:53 -0000 On 2013-03-13 18:57, Bjoern Hoehrmann wrote: > * Julian Reschke wrote: >> See test cases at: > >> So, please: >> >> - review test cases, >> >> - contribute new test cases, > > Single quotes, unclosed quote marks, \-escapes outside quotes, line Added. Added. Not yet added (concrete proposal?). > ending with \, case-sensitivity like BASIC, repeated realm parameter Not yet added. Added. > with difference in case, multiple headers, particularily combined with Not sure why that's particularly interesting. Regarding the remaining proposals: that's something my test framework does not support currently (httpd/mod_asis). > some of the other ideas, say > > WWW-Authenticate: Basic, realm="foo > WWW-Authenticate: bar" > > extension parameter before 'realm' (oh, you have that already), would > come to mind what does not seem covered by your tests already. Best regards, Julian From derhoermi@gmx.net Thu Mar 14 08:21:25 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 854C011E823C for ; Thu, 14 Mar 2013 08:21:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YcRD7C-ECD0c for ; Thu, 14 Mar 2013 08:21:20 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.18]) by ietfa.amsl.com (Postfix) with ESMTP id 9F6C511E829A for ; Thu, 14 Mar 2013 08:21:19 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.35]) by mrigmx.server.lan (mrigmx002) with ESMTP (Nemesis) id 0MLDZP-1UFsz93lp3-000KFv for ; Thu, 14 Mar 2013 16:21:18 +0100 Received: (qmail invoked by alias); 14 Mar 2013 15:21:18 -0000 Received: from p5B2329FC.dip.t-dialin.net (EHLO netb.Speedport_W_700V) [91.35.41.252] by mail.gmx.net (mp035) with SMTP; 14 Mar 2013 16:21:18 +0100 X-Authenticated: #723575 X-Provags-ID: V01U2FsdGVkX19cUZcLJQpcOYJuk7NTIQJmBk+7JA81JOJ8XlYDq1 /5swnlqg9nxscE From: Bjoern Hoehrmann To: Julian Reschke Date: Thu, 14 Mar 2013 16:21:20 +0100 Message-ID: References: <514075EE.4090300@gmx.de> <5141E8AE.9080905@gmx.de> In-Reply-To: <5141E8AE.9080905@gmx.de> X-Mailer: Forte Agent 3.3/32.846 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Y-GMX-Trusted: 0 Cc: http-auth@ietf.org Subject: Re: [http-auth] improving HTTP authentication in user agents X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 15:21:25 -0000 * Julian Reschke wrote: >On 2013-03-13 18:57, Bjoern Hoehrmann wrote: >> * Julian Reschke wrote: >>> See test cases at: >> >>> So, please: >>> >>> - review test cases, >>> >>> - contribute new test cases, >> >> Single quotes, unclosed quote marks, \-escapes outside quotes, line > >Added. Added. Not yet added (concrete proposal?). I was thinking something like realm=\h\e\l\l\o. >> ending with \, case-sensitivity like BASIC, repeated realm parameter > >Not yet added. Added. > >> with difference in case, multiple headers, particularily combined with > >Not sure why that's particularly interesting. > >Regarding the remaining proposals: that's something my test framework >does not support currently (httpd/mod_asis). http://lists.w3.org/Archives/Public/public-webapps/2010OctDec/0365.html Did you have any chance to try that yet? I recall testing it back then, but it's been a while. -- Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de 25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ From julian.reschke@gmx.de Thu Mar 14 08:54:53 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 83F2D11E8184 for ; Thu, 14 Mar 2013 08:54:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.849 X-Spam-Level: X-Spam-Status: No, score=-102.849 tagged_above=-999 required=5 tests=[AWL=-0.250, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oOp47GM4CvlR for ; Thu, 14 Mar 2013 08:54:46 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) by ietfa.amsl.com (Postfix) with ESMTP id 2C89611E8133 for ; Thu, 14 Mar 2013 08:54:46 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.17]) by mrigmx.server.lan (mrigmx002) with ESMTP (Nemesis) id 0Lir0l-1UsGb21j7l-00cxxZ for ; Thu, 14 Mar 2013 16:54:45 +0100 Received: (qmail invoked by alias); 14 Mar 2013 15:54:45 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.105]) [217.91.35.233] by mail.gmx.net (mp017) with SMTP; 14 Mar 2013 16:54:45 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX18ed6omKHkek1M9VtMFK0nbKIa1mMn04g5fLOlRee dzUFxwlc01wyIk Message-ID: <5141F2C2.5050005@gmx.de> Date: Thu, 14 Mar 2013 16:54:42 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Bjoern Hoehrmann References: <514075EE.4090300@gmx.de> <5141E8AE.9080905@gmx.de> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Cc: http-auth@ietf.org Subject: Re: [http-auth] improving HTTP authentication in user agents X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 15:54:53 -0000 On 2013-03-14 16:21, Bjoern Hoehrmann wrote: > * Julian Reschke wrote: >> On 2013-03-13 18:57, Bjoern Hoehrmann wrote: >>> * Julian Reschke wrote: >>>> See test cases at: >>> >>>> So, please: >>>> >>>> - review test cases, >>>> >>>> - contribute new test cases, >>> >>> Single quotes, unclosed quote marks, \-escapes outside quotes, line >> >> Added. Added. Not yet added (concrete proposal?). > > I was thinking something like realm=\h\e\l\l\o. OK, added. >>> ending with \, case-sensitivity like BASIC, repeated realm parameter >> >> Not yet added. Added. >> >>> with difference in case, multiple headers, particularily combined with >> >> Not sure why that's particularly interesting. >> >> Regarding the remaining proposals: that's something my test framework >> does not support currently (httpd/mod_asis). > > http://lists.w3.org/Archives/Public/public-webapps/2010OctDec/0365.html > Did you have any chance to try that yet? I recall testing it back then, > but it's been a while. I just tried, and that indeed works. I'll look into changing my test framework accordingly next week... Best regards, Julian From julian.reschke@gmx.de Thu Mar 14 08:58:41 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BB1011E81A0 for ; Thu, 14 Mar 2013 08:58:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.766 X-Spam-Level: X-Spam-Status: No, score=-102.766 tagged_above=-999 required=5 tests=[AWL=-0.167, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tyhU0UsO4zuS for ; Thu, 14 Mar 2013 08:58:40 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.18]) by ietfa.amsl.com (Postfix) with ESMTP id 0F5DE11E8192 for ; Thu, 14 Mar 2013 08:58:40 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.31]) by mrigmx.server.lan (mrigmx001) with ESMTP (Nemesis) id 0Md1TA-1Tz38f0jEg-00IFuv for ; Thu, 14 Mar 2013 16:58:39 +0100 Received: (qmail invoked by alias); 14 Mar 2013 15:58:39 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.105]) [217.91.35.233] by mail.gmx.net (mp031) with SMTP; 14 Mar 2013 16:58:39 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX18M+uwamvYMBkvBfZYBXQjkeP7uxYyWQ1qVr1V4nr XDLhrHUZOpTtLO Message-ID: <5141F3AC.6070307@gmx.de> Date: Thu, 14 Mar 2013 16:58:36 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: http-auth@ietf.org References: <51409549.7090605@gmx.de> In-Reply-To: <51409549.7090605@gmx.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Subject: Re: [http-auth] Revising the "Basic" parts of RFC 2617 X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 15:58:41 -0000 On 2013-03-13 16:03, Julian Reschke wrote: > Hi there, > > the above is in our charter, and I totally support that goal. > > Apart from extracting the text into a standalone document that > references HTTPbis-Part7, the following things should be done: > > 1) Rephrase the security considerations (for instance, with respect to > "Basic" over https). > > 2) *Explain* the I18N issue. > > 3) Update references where needed. > > 4) Resolve errata (the one I'm aware of -- > -- will > be gone once we update the document to reference HTTPbis). > > The charter also asks for > > 5) *fixing* the I18N issue. > > That's non-trivial; see > . > That draft has a *proposal* for fixing the issue, but it's > unimplemented. I do not believe we can claim it solves the I18N issue > unless we can show that it works in practice (two servers, to UAs). > ... While looking at my test cases, I remembered that there's also a I18N issue with respect to the "realm" parameter. My tests show that UAs currently treat it as ISO-8859-1. Not sure whether this *needs* to be addressed, nor how exactly. As an internal key, ASCII should be enough. For display purposes, we could add a "realm-title" or "prompt" parameter with proper I18N. Best regards, Julian From y.oiwa@aist.go.jp Thu Mar 14 11:35:25 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3D1621F90D3 for ; Thu, 14 Mar 2013 11:35:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.977 X-Spam-Level: X-Spam-Status: No, score=-5.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iSVzcYuV2VOV for ; Thu, 14 Mar 2013 11:35:25 -0700 (PDT) Received: from na3sys010aog106.obsmtp.com (na3sys010aog106.obsmtp.com [74.125.245.80]) by ietfa.amsl.com (Postfix) with ESMTP id C74B421F90CE for ; Thu, 14 Mar 2013 11:35:24 -0700 (PDT) Received: from mail-gh0-f197.google.com ([209.85.160.197]) (using TLSv1) by na3sys010aob106.postini.com ([74.125.244.12]) with SMTP ID DSNKUUIYbPeBALowXX+HTF9P/pUQ1WZk1ny5@postini.com; Thu, 14 Mar 2013 11:35:24 PDT Received: by mail-gh0-f197.google.com with SMTP id f15so3533528ghb.8 for ; Thu, 14 Mar 2013 11:35:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aist.go.jp; s=google; h=x-received:x-received:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=M0PzSAG2G117dbn4YdqhyphVSIBpA8gXAt+FKld6Vk8=; b=aYxCIZ0Czh+kj3t9wBz7gkx3GcLIuxeB2adtNzINyivIM5kVbfnhEkDEfvyF6PfWqx s4AxWX5CPC4zopfiupA+5r1ZPu3cEWhEwc3g0QkNnIlX4xc7VQu+kY6XvZG7Rd0epb+H 8St5vwqz3hOjyVy1PYWWm219039OddRWvIAvU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:x-received:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=M0PzSAG2G117dbn4YdqhyphVSIBpA8gXAt+FKld6Vk8=; b=Dk9pFDN93ccL36WnSA0G6L5sAyAfmd/NzecENNklacb2fPU+2X/tFZLAoYZ9O7Ljbb zz0HlYWHdEbXpV5v+RG4b9pAG9ZbAh+Hyt/y6mnSZeMSp19lfZLLmgf4M8KPRNy+bPkS avaHQlYDbOLWbzrXrB5amRH0/Amp9wiks6h5HwGzHccOiz5pqPHaes3dq7/NpvHRyCXd 6pXxavrcEcxDU41s2bJRDzx0X5ndio5IRHnsOWb10OLxRmR7ilVikIQa2vOUdcPaURYm 1dvP/it96eygNglWspla74X7oJgMcOZM69+ACmVX9p7xj4XHWaxWnRAlcMPKMesN8BFG AHfg== X-Received: by 10.58.213.37 with SMTP id np5mr3142880vec.54.1363286123864; Thu, 14 Mar 2013 11:35:23 -0700 (PDT) X-Received: by 10.58.213.37 with SMTP id np5mr3142872vec.54.1363286123770; Thu, 14 Mar 2013 11:35:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.58.77.101 with HTTP; Thu, 14 Mar 2013 11:35:02 -0700 (PDT) In-Reply-To: <5141F3AC.6070307@gmx.de> References: <51409549.7090605@gmx.de> <5141F3AC.6070307@gmx.de> From: Yutaka OIWA Date: Fri, 15 Mar 2013 03:35:02 +0900 Message-ID: To: Julian Reschke Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQm+lBaVoM0+zJbVt5AHCwKeAIg4kH254w/OjEM8CEQqhtLYvPOCCPUDGEduIMhaO/FH7sTcergWSwKp4DxtVPZWCO6G6v6I+ijPO1l6O7tRlLA7pDHWZEr/ALD37/EXqhpN7QLh/yl1uAK5uTk8/M/H9/epPA== Cc: http-auth@ietf.org Subject: Re: [http-auth] Revising the "Basic" parts of RFC 2617 X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 18:35:25 -0000 Dear Julian, 2013/3/15 Julian Reschke : > While looking at my test cases, I remembered that there's also a I18N issue > with respect to the "realm" parameter. My tests show that UAs currently > treat it as ISO-8859-1. Have you tested also with non-Latin-1-native environments? As far as I can test, IE9 in Japanese MS Windows parse the realm parameter with traditional locale charset (that is Shift_JIS). There are still some Websites and embedded systems which make use of Japanese realms in Shift_JIS encoding. # I guess this is why IE9 is still doing this tradition-origined behavior. Of course, I will NEVER say that this is the correct behavior. It is just an observation. Firefox 19 (Japanese localisation on Japanese MS Windows) seems to be parsing it in ISO-8859-1. I don't remember from which version FF honors this behavior. -- Yutaka OIWA, Ph.D. Leader, Software Reliability Research Group Research Institute for Secure Systems (RISEC) National Institute of Advanced Industrial Science and Technology (AIST) Mail addresses: , OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D 3139 8677 9BD2 4405 46B5] From julian.reschke@gmx.de Thu Mar 14 11:45:47 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCBE121F8DE8 for ; Thu, 14 Mar 2013 11:45:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wQyBz4+QvnP1 for ; Thu, 14 Mar 2013 11:45:47 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) by ietfa.amsl.com (Postfix) with ESMTP id C9D5521F8DEE for ; Thu, 14 Mar 2013 11:45:36 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.32]) by mrigmx.server.lan (mrigmx002) with ESMTP (Nemesis) id 0M2Jfm-1UZ7U247me-00s9FJ for ; Thu, 14 Mar 2013 19:45:35 +0100 Received: (qmail invoked by alias); 14 Mar 2013 18:45:34 -0000 Received: from p5DD96296.dip.t-dialin.net (EHLO [192.168.1.105]) [93.217.98.150] by mail.gmx.net (mp032) with SMTP; 14 Mar 2013 19:45:34 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX18G1UlqhWMGvfV7APVdc5OrCVdDmtpAyEzOa3W0VR vcKcp6vmcv0TDa Message-ID: <51421ACB.1090900@gmx.de> Date: Thu, 14 Mar 2013 19:45:31 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Yutaka OIWA References: <51409549.7090605@gmx.de> <5141F3AC.6070307@gmx.de> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Cc: http-auth@ietf.org Subject: Re: [http-auth] Revising the "Basic" parts of RFC 2617 X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 18:45:48 -0000 On 2013-03-14 19:35, Yutaka OIWA wrote: > Dear Julian, > > 2013/3/15 Julian Reschke : > >> While looking at my test cases, I remembered that there's also a I18N issue >> with respect to the "realm" parameter. My tests show that UAs currently >> treat it as ISO-8859-1. > > Have you tested also with non-Latin-1-native environments? Nope. > As far as I can test, IE9 in Japanese MS Windows parse > the realm parameter with traditional locale charset (that is Shift_JIS). Can you try ? > ... Best regards, Julian From tim-research@sentinelchicken.org Thu Mar 14 12:34:08 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A23B11E8166 for ; Thu, 14 Mar 2013 12:34:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1Z03Yeu+aHpg for ; Thu, 14 Mar 2013 12:34:07 -0700 (PDT) Received: from sentinelchicken.org (laim.sentinelchicken.org [96.126.98.9]) by ietfa.amsl.com (Postfix) with SMTP id 86C9911E80BF for ; Thu, 14 Mar 2013 12:34:07 -0700 (PDT) Received: (qmail 29110 invoked from network); 14 Mar 2013 19:34:05 -0000 Received: from unknown (HELO pascal.sentinelchicken.org) (10.81.64.2) by lelantos.sentinelchicken.org with SMTP; 14 Mar 2013 19:34:05 -0000 Received: (qmail 10041 invoked by uid 1000); 14 Mar 2013 20:06:14 -0000 Date: Thu, 14 Mar 2013 13:06:14 -0700 From: Tim To: Julian Reschke Message-ID: <20130314200614.GA9786@sentinelchicken.org> References: <514075EE.4090300@gmx.de> <20130313183717.GX4080@sentinelchicken.org> <5141D913.1000607@gmx.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5141D913.1000607@gmx.de> User-Agent: Mutt/1.5.20 (2009-06-14) Cc: http-auth@ietf.org Subject: Re: [http-auth] improving HTTP authentication in user agents X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 19:34:08 -0000 > >WWW-Authenticate: Basic > > realm="foo" > > Unfortunately, this is something my test setup (httpd with mod_asis) > won't generate. > > That being said: I'm mainly interested in *valid* responses (we > should achieve interop on valid header fields before even starting > to worry about invalid ones. (See ). Interesting, I didn't realize this was being deprecated. > >Also, I believe I've seen application servers decode things like %22 > >in quoted header fields before. I'm guessing this is incorrect > >behavior. So this might be a useful test: > > > >WWW-Authenticate: Basic realm="foo%22" > > Added as ; > apparently the browsers are sane with respect to this. Cool, thanks. tim From y.oiwa@aist.go.jp Thu Mar 14 12:40:50 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78E2911E820E for ; Thu, 14 Mar 2013 12:40:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.977 X-Spam-Level: X-Spam-Status: No, score=-6.977 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, GB_I_LETTER=-2, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JF9xlIta6MEb for ; Thu, 14 Mar 2013 12:40:49 -0700 (PDT) Received: from na3sys010aog108.obsmtp.com (na3sys010aog108.obsmtp.com [74.125.245.84]) by ietfa.amsl.com (Postfix) with ESMTP id F417411E8205 for ; Thu, 14 Mar 2013 12:40:46 -0700 (PDT) Received: from mail-vb0-f69.google.com ([209.85.212.69]) (using TLSv1) by na3sys010aob108.postini.com ([74.125.244.12]) with SMTP ID DSNKUUInvmoB414S5BIP/PVG9ghVSiEQsLoA@postini.com; Thu, 14 Mar 2013 12:40:48 PDT Received: by mail-vb0-f69.google.com with SMTP id ff20so3436834vbb.4 for ; Thu, 14 Mar 2013 12:40:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aist.go.jp; s=google; h=x-received:x-received:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=nDJXlByJUlZEro4Ger9svK8NEb7Eq5FwrbPCe/IWQA4=; b=ljJVqVOMiXPrGO6ePRABb4D/XEZGVOpv0D1pom/GoAmTEiHL+uztAGSHp+WvhKgHJH bNA5Hsl0BDPJN8mNPvQlyagiQHyeBp0CgUDYo0ChhQSxBXEIzcDClno2DP6rYgqWKiwA NRiRJ2P1cKJuPHDYau3Hn+8jHzSwngGhhjpEE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:x-received:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=nDJXlByJUlZEro4Ger9svK8NEb7Eq5FwrbPCe/IWQA4=; b=c875XiurAMunefdyADXm5o9GTMiokW6pU/d4/2ir8dDxNzjW0RdNfP7aO7c9dKSfj9 qGATlF9XXfiwfh4gIFcwBme2RKgqIAGNj8kyYy0Cf1I/sPQZRcoq837XP7ww3XoDGTcy GbqWODdY/FBcD9DxMaQ8FvUQ2jRn8yJLu1PxcfZ4aosiL0F9YamyS7Gx17VWC2ZoRfON 8/D0de5gUceV6F8KcSmBtusON0md2I3clxChvZWDJSDrvZFObofcRfyeXhjXxcxeT3Jg h5XBcu1qcjR6FNl0Ynk/jgARGORvvg4ysRoVMb6mSLmUZH7/WT2wH0thXE1KpjkYa2If KSjA== X-Received: by 10.58.213.37 with SMTP id np5mr3437701vec.54.1363290046059; Thu, 14 Mar 2013 12:40:46 -0700 (PDT) X-Received: by 10.58.213.37 with SMTP id np5mr3437692vec.54.1363290045934; Thu, 14 Mar 2013 12:40:45 -0700 (PDT) MIME-Version: 1.0 Received: by 10.58.77.101 with HTTP; Thu, 14 Mar 2013 12:40:24 -0700 (PDT) In-Reply-To: <51421ACB.1090900@gmx.de> References: <51409549.7090605@gmx.de> <5141F3AC.6070307@gmx.de> <51421ACB.1090900@gmx.de> From: Yutaka OIWA Date: Fri, 15 Mar 2013 04:40:24 +0900 Message-ID: To: Julian Reschke Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQmmqhUUvEzgBykGSEkB02l2MKDO6ZQvR4bezb2DGoHsincRTQKNIgXnbIkRpk7NSzVkxdTs3i0TqKkE7foxbfu5P8mdS3vr7z9/51orfBiqgXhTlA7y3PjFDFYV4wcAsYc3aqd0i82MqgaGRLrjYX8NuPx9hQ== Cc: http-auth@ietf.org Subject: Re: [http-auth] Revising the "Basic" parts of RFC 2617 X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 19:40:50 -0000 2013/3/15 Julian Reschke : >> As far as I can test, IE9 in Japanese MS Windows parse >> the realm parameter with traditional locale charset (that is Shift_JIS). > > > Can you try > ? Yes. http://www.oiwa.jp/~yutaka/temp/simplebasicrealmiso88591-ie9jp.png http://www.oiwa.jp/~yutaka/temp/simplebasicrealmiso88591-ff19jp.png IE9 shows the realm as "foo-", where the dot is actually a placeholder for unparsible multi-byte character. Another one with UTF-8 example, http://www.oiwa.jp/~yutaka/temp/simplebasicrealmutf8-ie9jp.png shows "foo-", where two half-width characters corresponds to C3 A4. -- Yutaka OIWA, Ph.D. Leader, Software Reliability Research Group Research Institute for Secure Systems (RISEC) National Institute of Advanced Industrial Science and Technology (AIST) Mail addresses: , OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D 3139 8677 9BD2 4405 46B5] From rifatyu@avaya.com Mon Mar 18 06:39:22 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E40F521F8DC0 for ; Mon, 18 Mar 2013 06:39:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.598 X-Spam-Level: X-Spam-Status: No, score=-3.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jz-sT2Tsvdqy for ; Mon, 18 Mar 2013 06:39:22 -0700 (PDT) Received: from co300216-co-outbound.net.avaya.com (co300216-co-outbound.net.avaya.com [198.152.13.100]) by ietfa.amsl.com (Postfix) with ESMTP id 096F921F8DB6 for ; Mon, 18 Mar 2013 06:39:21 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgMFAHpXMFHGmAcF/2dsb2JhbABEgkMjtygBiCV/FnOCIQEBAxIbTBIBFRUOSCYBBA4NEweHcQELpFacQ45jMR+CR2EDl1+Ee4pRgwiBayQY X-IronPort-AV: E=Sophos;i="4.84,760,1355115600"; d="scan'208,217";a="2506484" Received: from unknown (HELO co300216-co-erhwest.avaya.com) ([198.152.7.5]) by co300216-co-outbound.net.avaya.com with ESMTP; 18 Mar 2013 09:39:20 -0400 Received: from unknown (HELO AZ-US1EXHC02.global.avaya.com) ([135.11.85.13]) by co300216-co-erhwest-out.avaya.com with ESMTP; 18 Mar 2013 09:37:51 -0400 Received: from AZ-US1EXMB01.global.avaya.com ([fe80::54fa:ed52:888e:7ca8]) by AZ-US1EXHC02.global.avaya.com ([::1]) with mapi id 14.02.0328.009; Mon, 18 Mar 2013 09:39:19 -0400 From: "Shekh-Yusef, Rifaat (Rifaat)" To: "http-auth@ietf.org" Thread-Topic: HTTP Digest Encoding Thread-Index: Ac4j3f1/Zo4fzchST8uXec/e1Fv9rQ== Date: Mon, 18 Mar 2013 13:39:19 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.11.85.48] Content-Type: multipart/alternative; boundary="_000_C563F76EA324474CA3722A35154AFDB3139EB3E3AZUS1EXMB01glob_" MIME-Version: 1.0 Cc: Julian Reschke Subject: [http-auth] HTTP Digest Encoding X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2013 13:39:23 -0000 --_000_C563F76EA324474CA3722A35154AFDB3139EB3E3AZUS1EXMB01glob_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello, Julian and I discussed this offline and we think that the mechanism defined= in http://tools.ietf.org/html/draft-reschke-basicauth-enc-07 could be used= to address the HTTP Digest encoding issue. The following is some text that we think we could add to the above draft to= address this issue. --- In challenges, servers MAY use the "accept-charset" authentication paramete= r (case-insensitive) to express the character encoding they expect the user= agent to use. If the user agent supports the encoding indicated by the server, it SHOULD = add the "accept-charset" parameter, with the value it received from the ser= ver, to the Proxy-Authenticate or WWW-Authenticate header fields it sends b= ack to the server. If the user agent does not support the encoding indicated by the server, it= SHOULD add the "accept-charset" parameter to the Proxy-Authenticate or WWW= -Authenticate header fields it sends back to the server, but the value in t= he parameter should be preceded by an exclamation point (!). A user agent that does not follow this specification will ignore the parame= ter and will not include it in any response to the server. When the server receives the new request with the Proxy-Authenticate or WWW= -Authenticate header fields, it looks for the "accept-charset" parameter. I= f the "accept-charset" parameter is present, and its value matches the enco= ding the server sent to the client, the server will continue with its norma= l operation using the encoding it sent to the client. If, on the other hand= , the "accept-charset" parameter value is preceded by an exclamation point = (!), the server can immediately decline the request. If the new request with the Proxy-Authenticate or WWW-Authenticate header f= ields does not have the "accept-charset" parameter, the server will know th= at it is dealing with a client that does not support this specification and= should continue to perform its current operation. The encoding indicated by the server impacts the way the server and the use= r agent concatenate the username-value, realm-value, and password when they= calculate A1, as defined in section 3.2.2.2 of RFC2617. --- What we are missing is information on how this currently works in practice,= as this might help us either validate the above proposal or guide us to fi= nd the proper solution to the real world issue. We would appreciate any feedback on the text above or any information on cu= rrent practices. Regards, Rifaat --_000_C563F76EA324474CA3722A35154AFDB3139EB3E3AZUS1EXMB01glob_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hello,

 

Julian and I discussed this offline and we think that the mechanism defi= ned in http://tools.ietf.org/html/draft-reschke-basicauth= -enc-07 could be used to address the HTTP Digest encoding issue.

The following is some text that we think we could add to the above draft= to address this issue.

 

---

In challenges, servers MAY use the "accept-charset" authentica= tion parameter (case-insensitive) to express the character encoding they ex= pect the user agent to use.

 

If the user agent supports the encoding indicated by the server, it SHOU= LD add the "accept-charset" parameter, with the value it received= from the server, to the Proxy-Authenticate or WWW-Authenticate header fields it sends back to the server.

 

If the user agent does not support the encoding indicated by the server,= it SHOULD add the "accept-charset" parameter to the Proxy-Authen= ticate or WWW-Authenticate header fields it sends back to the server, but the value in the parameter should be preceded by a= n exclamation point (!).

 

A user agent that does not follow this specification will ignore the par= ameter and will not include it in any response to the server.

 

When the server receives the new request with the Proxy-Authenticate or = WWW-Authenticate header fields, it looks for the "accept-charset"= parameter. If the "accept-charset" parameter is present, and its value matches the encoding the server sent to the client,= the server will continue with its normal operation using the encoding it s= ent to the client. If, on the other hand, the "accept-charset" pa= rameter value is preceded by an exclamation point (!), the server can immediately decline the request.

 

If the new request with the Proxy-Authenticate or WWW-Authenticate heade= r fields does not have the "accept-charset" parameter, the server= will know that it is dealing with a client that does not support this specification and should continue to perform its cur= rent operation.

 

The encoding indicated by the server impacts the way the server and the = user agent concatenate the username-value, realm-value, and password when t= hey calculate A1, as defined in section 3.2.2.2 of RFC2617.

---

 

 

What we are missing is information on how this currently works in practi= ce, as this might help us either validate the above proposal or guide us to= find the proper solution to the real world issue.

We would appreciate any feedback on the text above or any information on= current practices.

 

Regards,

 Rifaat

 

 

--_000_C563F76EA324474CA3722A35154AFDB3139EB3E3AZUS1EXMB01glob_-- From julian.reschke@gmx.de Mon Mar 18 07:30:19 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAA6321F8F0B for ; Mon, 18 Mar 2013 07:30:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.488 X-Spam-Level: X-Spam-Status: No, score=-104.488 tagged_above=-999 required=5 tests=[AWL=-0.889, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UziyiHU10pEj for ; Mon, 18 Mar 2013 07:30:19 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.15]) by ietfa.amsl.com (Postfix) with ESMTP id EB0CF21F8CF9 for ; Mon, 18 Mar 2013 07:30:18 -0700 (PDT) Received: from mailout-de.gmx.net ([10.1.76.30]) by mrigmx.server.lan (mrigmx001) with ESMTP (Nemesis) id 0MJ0Rb-1UJX190EFl-002UG9 for ; Mon, 18 Mar 2013 15:30:18 +0100 Received: (qmail invoked by alias); 18 Mar 2013 14:30:17 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.105]) [217.91.35.233] by mail.gmx.net (mp030) with SMTP; 18 Mar 2013 15:30:17 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX18Na0ci7CcN6xoqU9+eUVz1/FNLGA9rlVgLqZPlbv wI+P+22j7kEN68 Message-ID: <514724F7.3080302@gmx.de> Date: Mon, 18 Mar 2013 15:30:15 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: "Shekh-Yusef, Rifaat (Rifaat)" References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Cc: "http-auth@ietf.org" Subject: Re: [http-auth] HTTP Digest Encoding X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2013 14:30:19 -0000 On 2013-03-18 14:39, Shekh-Yusef, Rifaat (Rifaat) wrote: > Hello, > > Julian and I discussed this offline and we think that the mechanism > defined inhttp://tools.ietf.org/html/draft-reschke-basicauth-enc-07could > be used to address the HTTP Digest encoding issue. > > The following is some text that we think we could add to the above draft > to address this issue. > ... Clarifying: it seems that Digest suffers from the same problem as Basic: it concatenates some information from strings, and then hashes them (Basic: base64-encodes) them without explaining how to get from characters to octets. The proposed solution for Basic looks the way it is due to how clients currently work. Before jumping to conclusions, we need to find out whether the situation for Digest is indeed the same. *If* we adopt a similar strategy, Digest should be consistent with Basic in that the only acceptable charset name (vs not specifying at all as in RFC 2617) is "utf-8". For now I'd be -1 on expanding basicauth-enc with information about Digest, until the necessary research has happened. Best regards, Julian