W3C home > Mailing lists > Public > ietf-http-wg@w3.org > July to September 2011

Re: #78: Relationship between 401, Authorization and WWW-Authenticate

From: Willy Tarreau <w@1wt.eu>
Date: Sun, 24 Jul 2011 20:11:38 +0200
To: Mark Nottingham <mnot@mnot.net>
Cc: HTTP Working Group <ietf-http-wg@w3.org>
Message-ID: <20110724181138.GW22405@1wt.eu>
On Sun, Jul 24, 2011 at 02:06:17PM -0400, Mark Nottingham wrote:
> <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/78>
> Proposal:
> 1) Clarify that WWW-Authenticate can appear on any response, and that when it appears on any other than a 401, it means that the client can optionally present the request again with a credential.

Does this mean it's only for other 4xx or for any status ? It might have
implications with non-idempotent requests if a client can repost a request
that led to a 200 for instance.

> and,
> 2) Clarify that an Authentication scheme that uses WWW-Authenticate and/or 401 MUST use the Authorization header in the request, because of its implications for caching. Schemes MAY specify additional headers to be used alongside it.

This looks important indeed !

Received on Sunday, 24 July 2011 18:12:03 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 1 March 2016 11:10:58 UTC