Re: Proposal for new HTTP 1.1 authentication scheme

On 12 Dec 1997, Foteos Macrides wrote:
> 
> >> What does "last symbolic element in the path field of the Request-URI"
> >> mean?
> >
> >Maybe an example is best. Assume the Request-URI is
> >"http://somewhere/the/path/index.html" then you want to to talk about all
> >URIs with a prefix of "http://somewhere/the/path/", i.e. the scheme, the
> >site component and the path component of the Request-URI minus any trailing
> >segment. I assumed "symbolic element" to refer to "/".
> 
> 	Your example is correct, but "symbolic elements" refers to
> the "substrings in a URL path that comprise a hierarchy delimited
> by slashes".
[snip]

Thanx for the (very clear) explanation. I suppose one could just substitute
"symbolic element" by "segment".

> 	I'm not sure how well that would work in conjunction with
> nounce handing, and other aspects of Digest authentication which
> are more complicated than Basic, but agree with you that most
> implementors would like it to be as "drop in" as possible with
> respect to existing Basic implementations.

The nonce is not (that much of) a problem. If you previously got a
nextnonce then use that, otherwise just use the previously used nonce.
When pre-emptively sending auth info the main difference between Basic
and Digest authentication is that you have to recalculate the response
digest (and possibly entity-digest) and adjust the various parameters,
instead of just sending exact same header as you can do in Basic. So
the prefix idea works just fine with Digest.


  Cheers,

  Ronald

Received on Friday, 12 December 1997 21:20:31 UTC