RE: Security Requirements for HTTP, draft -00

-----Original Message-----
From: ietf-http-wg-request@w3.org [mailto:ietf-http-wg-request@w3.org] On Behalf Of Roy T. Fielding
Sent: Friday, February 01, 2008 12:51 PM
To: Paul Hoffman
Cc: HTTP Working Group

>
> Number of requests per day.

Not even close.  Regular old HTTP authentication requests outnumber
browser-driven forms-based use of the Web (on a per request basis)
by an order of magnitude.
[Paul Leach] Are you taking into account that, after an FBA, subsequent requests to the same site are authorized by a cookie (i.e., they have no auth headers at all), whereas with Basic every request has an auth header? If not, your statement could be strictly speaking correct, but you'd be using a metric that's different than what other people have in mind as being on a "per request basis".

Received on Friday, 1 February 2008 22:39:56 UTC