Re: security requirements (was: Updating RFC 2617 (HTTP Digest) to use UTF-8) from William A. Rowe, Jr. on 2006-11-05 (ietf-http-wg@w3.org from October to December 2006)

From: William A. Rowe, Jr. <wrowe@rowe-clan.net>
Date: Sun, 05 Nov 2006 00:22:06 -0600
To: Paul Leach <paulle@windows.microsoft.com>
CC: Robert Sayre <sayrer@gmail.com>, Henrik Nordstrom <hno@squid-cache.org>, HTTP Working Group <ietf-http-wg@w3.org>
Message-ID: <454D830E.1060700@rowe-clan.net>

Paul Leach wrote:
> 
> That's because making a protocol feature mandatory-to-implement does NOT
> make it mandatory to configure. Hence, for example, one could not
> deduce, from either an HTTP/1.1 or a new HTTP/1.2 sent by a client, that
> a server can send Basic or Digest challenge and be assured that it will
> be understood by the client.

Not if they implemented an RFC 2616 client.

Received on Sunday, 5 November 2006 06:22:09 UTC