- From: Ian Hickson <ian@hixie.ch>
- Date: Mon, 8 Nov 2004 23:56:07 +0000 (UTC)
On Fri, 27 Aug 2004, Aaron Swartz wrote:
>
> +1 to adding HTML support for Digest Auth. This is a well-needed
> security measure. And it'd b easy to make it backwards compatible (with
> an attribute on <form> for example) so that if the browser didn't
> support the new HTML features it would fall back to a traditional HTTP
> POST.
I agree this would be great.
The problem is I can't work out how to do it.
Here's how I imagine the ideal setup would be:
1. Form appears on a non-authenticated page, e.g. on the home page of
http://www.example.com/
2. If the user uses the form in a legacy UA, it does a post (or similar)
to a URI, and the user appears logged in.
3. If the user uses the form in a WF2 UA, it does a post (or similar) to
a URI, and sends HTTP authentication information in the process.
Parts 1 and 3 are relatively easy, just a matter of deciding on some
syntax. Part 2 is the problem. I guess part 2 could be implemented by
using redirects to user:password at host URIs, but IE6 on XPSP2 doesn't
support that anymore.
If we don't do that, then we are basically down to:
1. Form appears on a non-authenticated page, e.g. on the home page of
http://www.example.com/
2. If the user uses the form in a legacy UA, it does a post (or similar)
to a URI, which then asks the user for authentication (again) using
the UA's HTTP support.
3. If the user uses the form in a WF2 UA, it does a post (or similar) to
a URI, and sends HTTP authentication information in the process.
Maybe we should hide the username/password fields from legacy UAs, so that
on old UAs it just has a login button, but new UAs have the button as
well as username and password fields?
What do people think? Any opinions?
--
Ian Hickson U+1047E )\._.,--....,'``. fL
http://ln.hixie.ch/ U+263A /, _.. \ _\ ;`._ ,.
Things that are impossible just take longer. `._.-(,_..'--(,_..'`-.;.'
Received on Monday, 8 November 2004 15:56:07 UTC