- From: Musatov, Martin - CW <Martin.Musatov@bestbuy.com>
- Date: Mon, 4 Jun 2012 14:58:07 +0000
- To: HTTP Working Group <ietf-http-wg@w3.org>
Why is a great deal of the content on the HTTP working seem so tongue and cheek, people making obscure gestures with double sets of quotes, blank lines, spaces and capitalization? It reminds me of: Proverbs 6:13 He winks with his eyes and strikes with his feet and he signals with his fingers, Just an observation -----Original Message----- From: James French [mailto:jfrench@denirostaff.com] Sent: Thursday, May 31, 2012 11:20 AM To: Mark Nottingham Cc: HTTP Working Group Subject: Re: WGLC #349: "strength" On Thu, May 31, 2012 at 5:20 AM, Mark Nottingham <mnot@mnot.net> wrote: > <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/349> > > Proposal: change > >> Both the Authorization field value and the Proxy-Authorization field >> value consist of credentials containing the authentication >> information of the client for the realm of the resource being >> requested. The user agent MUST choose to use one of the challenges >> with the strongest auth-scheme it understands and request credentials >> from the user based upon that challenge. > > > to > > """ > Both the Authorization field value and the Proxy-Authorization field value contain the client's credentials for the realm of the resource being requested, based upon a challenge received from the server (possibly at some point in the past). When creating their values, the user agent ought to do so by selecting the challenge with what it considers to be the most secure auth-scheme that it understands, obtaining credentials from the user as appropriate. Perhaps this phrase "ought to" should be an all-caps (RFC 2119) SHOULD?
Received on Monday, 4 June 2012 17:31:38 UTC