Re: Authentication realm

Eran Hammer-Lahav wrote:
> RFC 2617 declares:
> 
>    The realm directive (case-insensitive) is required for all
>    authentication schemes that issue a challenge.
> 
> But does not use normative REQUIRED. Also, the ABNF defines challenge as:

"required" is as normative as "REQUIRED". See 
<http://tools.ietf.org/html/bcp14>:

"These words are *often* capitalized.

(emphasis mine)

>    challenge   = auth-scheme 1*SP 1#auth-param
> 
> Which seems to suggest that the realm parameter is not actually mandatory. If it is, the language should be corrected to use normative REQUIRED and the ABNF changes to reflect that:
> 
>   challenge = auth-scheme 1*SP 1#(realm / auth-param)

That wouldn't really change the requirement from the ABNF perspective. 
Due to the complexity of the # rule, putting the requirement into the 
ABNF is non-trivial, and I guess that's the reason why it didn't happen.

> As currently defined, realm doesn't fully cover the use cases of the proposed Token scheme (OAuth WG). We will need to either redefine it, supplement it, or replace it. Either way, we need to know what is dictated by the HTTP authentication framework.

Could you elaborate on that?

Best regards, Julian

Received on Monday, 7 December 2009 11:15:43 UTC