W3C home > Mailing lists > Public > ietf-http-wg-old@w3.org > September to December 1997

Access control and knowledge

From: Ingrid Melve <Ingrid.Melve@uninett.no>
Date: Thu, 20 Nov 1997 13:52:26 +0100
Message-Id: <199711201245.NAA16576@tyholt.uninett.no>
To: http-wg%cuckoo.hpl.hp.com@hplb.hpl.hp.com
Cc: Ingrid.Melve@uninett.no, Simon Wilkinson <sxw@tardis.ed.ac.uk>, martin@mrrl.lut.ac.uk

Web caches and indexing robots are examples of user agents who do not act
on behalf of one end user.  The problem of access control when sharing
indexes or caches is not trivial for documents who have access control
based on IP number or domain name, since there is no indication of
access control being used for the particular document.  

Several popular web servers permit users to create their own access control,
like Apache does with local .htaccess files, and the local webmaster
may not know about access restrictions.  This excludes the use of robots.txt
file for sharing this information with indexing robots, and the caches
would not be helped.

Cache-control: private has been considered, but it does not
permit sharing information with those in the same realm.

If an extra header indicating that access control was used, is sent 
with the document this problem would be solved.  
With information of the access list, caches and indexes may still 
be shared and give access to the appropriate information
without compromising security.  Two access restrictions that easily
lend themselves to this are IP numbers and domain names.

Proposed new header
 Restricted: ACL

If the definition of WWW-Authenticate is reused from HTTP/1.1, 
the two special cases would be
  Restricted: IPnr realm="129.215.0.0/255.255.0.0"
  Restricted: Domain realm=".dcs.ed.ac.uk"

This header does not ensure the security of a document, but gives multi-user agents an opportunity to restrict access.  If an unknown realm is encountered, the indexing robot or cache should treat the document as restricted and not share information.


Ingrid
 (who would rather have sent this message to the HTTP-extentions group or the web cache protocols group or the HTTPSEC group or the shared indexing group)
-- 
  Ingrid.Melve@uninett.no         UNINETT, N-7034 Trondheim, Norway
   Phone +47 73 55 79 07   Fax +47 73 55 79 01   
                 http://domen.uninett.no/~im/eng.html
 "Sometimes it is better to light a flamethrower than curse the darkness"
Received on Thursday, 20 November 1997 04:48:30 EST

This archive was generated by hypermail pre-2.1.9 : Wednesday, 24 September 2003 06:33:03 EDT