<http://www.satec.es/plant_correo/img/Logo_sistemas.gif>
Hi all,
some comments on yesterday's issue about http authentication.
This authrentication is triggered by the server returning a 401 message
(Unauthorized) to the browser when a server resource is protected and
session credentials are not sent in the request by the browser. The
authentication method in the header (WWW-Authenticate) can be "Basic" or
"Digest".
Then, the browser sends user and pasword to the server. In case "digest" is
requested, the password is hashed with MD5. I am not sure whether other hash
functions are allowed. Otherwise, the user and password are Base-64 encoded.
The server checks the authorization of the user and proceeds normally if
everything is OK or returns a 401 message if it fails.
IMO, this process does not require any additional markup in the XForms spec.
It should be all internally handled by the submission module.
A different issue is whether the spec should state that this authentication
methods have to be supported by the submission module.
The same issue could be extended to authentication with digital certificate
within the SSL protocol. Furthermore, proxy authentication could also be
considered.
Regards,
Rafael Benito Ruíz de Villa
Director Area e-business
Móvil (+34) 617 314 293
rbenito@satec.es
MADRID <http://www.satec.es>
Avda. Europa, 34 A
28023 Aravaca
Telf.: (+34) 91 708 90 00 / 91 211 03 00
Fax: (+34) 91 708 90 90 / 91 211 03 90
