- From: Stefan Eissing <stefan.eissing@greenbytes.de>
- Date: Mon, 16 Sep 2002 10:44:00 +0200
- To: "Lisa Dusseault" <lisa@xythos.com>
- Cc: "Webdav WG" <w3c-dist-auth@w3c.org>
Am Sonntag den, 15. September 2002, um 20:13, schrieb Lisa Dusseault: > > RFC 2518 is silent on cookies. It requires support for RFC2068 (now > RFC2616), but does not reference the HTTP Cookie RFC (RFC 2965). > > Some WebDAV servers, however, rely on setting cookies to keep a session > for an unauthenticated user. For Basic authentication, cookies can > vastly reduce the number of times a nearly-clear-text password is sent > over the network, so cookies can make the interaction more secure. > Session cookies are less secure than Digest authentication, however > servers with low security requirements and high performance > requirements > may prefer to use cookies. > > In addition to being used for keeping sessions, cookies may be used to > keep track of other client preferences (this is theoretical as I do not > know of any actual examples). > > Thus, it was proposed that RFC2518 bis reference RFC2965, and say that > "clients SHOULD support cookies". I think we agree that a server should not depend on the client handling cookies. WebDAV needs to function without them. Therefore the spec should not mention them. I see the risk that servers or client implementors might be tempted to rely on it. It is certainly a good idea to collect implementation advice in some FAQ or the webdav book of why. //Stefan
Received on Monday, 16 September 2002 06:17:35 UTC