W3C home > Mailing lists > Public > ietf-http-wg@w3.org > July to September 2011

#78: Relationship between 401, Authorization and WWW-Authenticate

From: Mark Nottingham <mnot@mnot.net>
Date: Sun, 24 Jul 2011 14:06:17 -0400
Message-Id: <798C1D1A-C0C7-40DD-8993-31DB735A4961@mnot.net>
To: HTTP Working Group <ietf-http-wg@w3.org>
<http://trac.tools.ietf.org/wg/httpbis/trac/ticket/78>

Proposal:

1) Clarify that WWW-Authenticate can appear on any response, and that when it appears on any other than a 401, it means that the client can optionally present the request again with a credential.

and,

2) Clarify that an Authentication scheme that uses WWW-Authenticate and/or 401 MUST use the Authorization header in the request, because of its implications for caching. Schemes MAY specify additional headers to be used alongside it.

--
Mark Nottingham   http://www.mnot.net/
Received on Sunday, 24 July 2011 18:06:50 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Friday, 27 April 2012 06:51:45 GMT