WGLC issue: "Realms and scope" in p7

There's an implicit acknowledgement that one resource does not know
about another (from p3):

   A cache cannot assume that a representation with a Content-Location
   different from the URI used to retrieve it can be used to respond to
   later requests on that Content-Location URI.

However, the mechanism we use (and rely upon for performance) from p7
makes no concessions on that point.  A server that operates separate
fiefdoms by allocating different portions of path-space cannot prevent
one vassal state from learning the secrets of any other that uses
these authentication mechanisms we so love to hate.

For instance, if "/kind/and/naive" is authenticated in the realm
"puppies", then "/kinda/shifty" can harvest their authentication
information if a logged in user agent navigates there. See "log out"
discussion for exacerbating stuff.  User agents don't know (or care)
for this distinction.

Of course, this is all pretty obvious, but is this worth acknowledging
in Section 6?

Received on Friday, 16 March 2012 03:40:01 UTC