- From: <internet-drafts@ietf.org>
- Date: Wed, 28 Aug 2024 14:28:39 -0700
- To: <i-d-announce@ietf.org>
- Cc: ietf-http-wg@w3.org
Internet-Draft draft-ietf-httpbis-unprompted-auth-10.txt is now available. It
is a work item of the HTTP (HTTPBIS) WG of the IETF.
Title: The Concealed HTTP Authentication Scheme
Authors: David Schinazi
David M. Oliver
Jonathan Hoyland
Name: draft-ietf-httpbis-unprompted-auth-10.txt
Pages: 17
Dates: 2024-08-28
Abstract:
Most HTTP authentication schemes are probeable in the sense that it
is possible for an unauthenticated client to probe whether an origin
serves resources that require authentication. It is possible for an
origin to hide the fact that it requires authentication by not
generating Unauthorized status codes, however that only works with
non-cryptographic authentication schemes: cryptographic signatures
require a fresh nonce to be signed. At the time of writing, there
was no existing way for the origin to share such a nonce without
exposing the fact that it serves resources that require
authentication. This document proposes a new non-probeable
cryptographic authentication scheme.
The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpbis-unprompted-auth/
There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-httpbis-unprompted-auth-10.html
A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-ietf-httpbis-unprompted-auth-10
Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts
Received on Wednesday, 28 August 2024 21:28:44 UTC