- From: Julian Reschke <julian.reschke@gmx.de>
- Date: Wed, 30 Oct 2013 15:45:16 +0100
- To: Stephen Kent <kent@bbn.com>, secdir <secdir@ietf.org>, fielding@gbiv.com, mnot@pobox.com, Barry Leiba <barryleiba@computer.org>, Pete Resnick <presnick@qti.qualcomm.com>, "Mankin, Allison" <amankin@verisign.com>, HTTP Working Group <ietf-http-wg@w3.org>
Hi Stephen,
On 2013-10-30 15:32, Stephen Kent wrote:
> ...
>>> The SC section here addresses only two issues: purging credentials in
>>> clients and user agents, and protection spaces. The discussion of the
>>> former topic does not discuss how credential purging applies to proxies.
>>
>> As per httpbis-p1, a proxy is a client as well ('An HTTP "client" is a
>> program that establishes a connection to a server for the purpose of
>> sending one or more HTTP requests.' --
>> <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-24.html#rfc.section.2.1>).
>> Does this address your comment?
> yes, but it might be clearer to note this, parenthetically, in this doc.
> For example, page 5 includes the following text:
>
> The 407 (Proxy Authentication Required) response message is used by a
>
> proxy to challenge the authorization of a client and MUST include a
>
> Proxy-Authenticate header field containing at least one challenge
>
> applicable to the proxy for the requested resource.
>
>
> The use of the terms "proxy" and "client" here suggest that they are
> distinct notions,
> not that a proxy is also considered a client.
In the context of this paragraph, the proxy is indeed the server.
>>> Also, it is not clear that a user control for credential purging will
>>> have the desired effect given a potentially complex GUI environment. The
>>
>> Any proposal for enhancing the text?
>
> User agents that cache credentials are encouraged to provide a
>
> readily accessible mechanism for discarding cached credentials under
>
> user control. *We recognize that this may not be a trivial task.**
> ** Designing a UI that will encourage users to purge credentials when**
> ** appropriate, but not cause them to prematurely do so may be difficult.*
In my experience, the implementers of browsers are very aware of the
problems with coming up with a good UI. I really don't think that adding
more prose here will help at all. (But hey, I asked for a proposal and
you sent one; thanks for that!).
> ...
Best regards, Julian
Received on Wednesday, 30 October 2013 14:45:48 UTC