Re: Proposal for new HTTP 1.1 authentication scheme

On Tue, 9 Dec 1997, Dave Kristol wrote:
> 
> I like Benjamin Franz's suggestion of a fixed date that means "this is
> not a date" as a placeholder.

Yes, this makes sense.

> Content-length is another matter.  If the client sends the entity with
> chunked encoding, it probably does not know the content length, although
> it may calculate an entity-digest on the fly (and add it as a
> trailer?).  But the proxy may coalesce the entity and add a
> Content-length header.  Now what?  The entity-digest as calculated by
> the two parties will be different because of the Content-length.
> 

I believe that entity headers like Content-MD5, Content-Length,
etc. refer to the entity after any Content-encoding has been applied,
but before any hop-by-hop Transfer-encoding has been applied.  

The specification is pretty explicit about this:

       "Entity-header fields define optional metainformation about the
       entity-body..."


       "The entity-body is obtained from the message-body by decoding
       any Transfer-Encoding that may have been applied to ensure safe
       and proper transfer of the message."

This is important as it would be impossible to put Content-MD5 in a
chunked trailer, if the MD5 hash was calculated on the chunked entity.
Likewise Authentication-Info is explicitly allowed in a chunked
trailer and it depends on the Content-Length.

In any case, it seems the Content-length of an entity is the length
before any chunking.  Thus if a proxy removes chunking and adds a
Contact-Length header that should not introduce any errors in 
entity-digest calculation.

Am I missing something?

John Franks
john@math.nwu.edu

Received on Tuesday, 9 December 1997 20:12:49 UTC