| draft-ietf-httpbis-p7-auth-08.txt |  | draft-ietf-httpbis-p7-auth-09.txt |
--- | --- | --- | --- | ---
| HTTPbis Working Group R. Fielding, Ed. |  | HTTPbis Working Group R. Fielding, Ed. |
| Internet-Draft Day Software |  | Internet-Draft Day Software |
| Obsoletes: 2616 (if approved) J. Gettys |  | Obsoletes: 2616 (if approved) J. Gettys |
| Updates: 2617 (if approved) One Laptop per Child |  | Updates: 2617 (if approved) One Laptop per Child |
| Intended status: Standards Track J. Mogul |  | Intended status: Standards Track J. Mogul |
| Expires: April 29, 2010 HP |  | Expires: September 9, 2010 HP |
| H. Frystyk |  | H. Frystyk |
| Microsoft |  | Microsoft |
| L. Masinter |  | L. Masinter |
| Adobe Systems |  | Adobe Systems |
| P. Leach |  | P. Leach |
| Microsoft |  | Microsoft |
| T. Berners-Lee |  | T. Berners-Lee |
| W3C/MIT |  | W3C/MIT |
| Y. Lafon, Ed. |  | Y. Lafon, Ed. |
| W3C |  | W3C |
| J. Reschke, Ed. |  | J. Reschke, Ed. |
| greenbytes |  | greenbytes |
| October 26, 2009 |  | March 8, 2010 |
| HTTP/1.1, part 7: Authentication |  | HTTP/1.1, part 7: Authentication |
| draft-ietf-httpbis-p7-auth-08 |  | draft-ietf-httpbis-p7-auth-09 |
|  |  | Abstract |
|  |  | The Hypertext Transfer Protocol (HTTP) is an application-level |
|  |  | protocol for distributed, collaborative, hypermedia information |
|  |  | systems. HTTP has been in use by the World Wide Web global |
|  |  | information initiative since 1990. This document is Part 7 of the |
|  |  | seven-part specification that defines the protocol referred to as |
|  |  | "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 7 defines |
|  |  | HTTP Authentication. |
|  |  | Editorial Note (To be removed by RFC Editor) |
|  |  | Discussion of this draft should take place on the HTTPBIS working |
|  |  | group mailing list (ietf-http-wg@w3.org). The current issues list is |
|  |  | at <http://tools.ietf.org/wg/httpbis/trac/report/11> and related |
|  |  | documents (including fancy diffs) can be found at |
|  |  | <http://tools.ietf.org/wg/httpbis/>. |
|  |  | The changes in this draft are summarized in Appendix C.10. |
| Status of this Memo |  | Status of this Memo |
| This Internet-Draft is submitted to IETF in full conformance with the |  | This Internet-Draft is submitted to IETF in full conformance with the |
| provisions of BCP 78 and BCP 79. This document may contain material |  | provisions of BCP 78 and BCP 79. |
| from IETF Documents or IETF Contributions published or made publicly |  |  |
| available before November 10, 2008. The person(s) controlling the |  |  |
| copyright in some of this material may not have granted the IETF |  |  |
| Trust the right to allow modifications of such material outside the |  |  |
| IETF Standards Process. Without obtaining an adequate license from |  |  |
| the person(s) controlling the copyright in such materials, this |  |  |
| document may not be modified outside the IETF Standards Process, and |  |  |
| derivative works of it may not be created outside the IETF Standards |  |  |
| Process, except to format it for publication as an RFC or to |  |  |
| translate it into languages other than English. |  |  |
| Internet-Drafts are working documents of the Internet Engineering |  | Internet-Drafts are working documents of the Internet Engineering |
| Task Force (IETF), its areas, and its working groups. Note that |  | Task Force (IETF), its areas, and its working groups. Note that |
| other groups may also distribute working documents as Internet- |  | other groups may also distribute working documents as Internet- |
| Drafts. |  | Drafts. |
| Internet-Drafts are draft documents valid for a maximum of six months |  | Internet-Drafts are draft documents valid for a maximum of six months |
| and may be updated, replaced, or obsoleted by other documents at any |  | and may be updated, replaced, or obsoleted by other documents at any |
| time. It is inappropriate to use Internet-Drafts as reference |  | time. It is inappropriate to use Internet-Drafts as reference |
| material or to cite them other than as "work in progress." |  | material or to cite them other than as "work in progress." |
| skipping to change at page 2, line 4 |  | skipping to change at page 2, line 14 |
| Internet-Drafts are working documents of the Internet Engineering |  | Internet-Drafts are working documents of the Internet Engineering |
| Task Force (IETF), its areas, and its working groups. Note that |  | Task Force (IETF), its areas, and its working groups. Note that |
| other groups may also distribute working documents as Internet- |  | other groups may also distribute working documents as Internet- |
| Drafts. |  | Drafts. |
| Internet-Drafts are draft documents valid for a maximum of six months |  | Internet-Drafts are draft documents valid for a maximum of six months |
| and may be updated, replaced, or obsoleted by other documents at any |  | and may be updated, replaced, or obsoleted by other documents at any |
| time. It is inappropriate to use Internet-Drafts as reference |  | time. It is inappropriate to use Internet-Drafts as reference |
| material or to cite them other than as "work in progress." |  | material or to cite them other than as "work in progress." |
| The list of current Internet-Drafts can be accessed at |  | The list of current Internet-Drafts can be accessed at |
| http://www.ietf.org/ietf/1id-abstracts.txt. |  | http://www.ietf.org/ietf/1id-abstracts.txt. |
| The list of Internet-Draft Shadow Directories can be accessed at |  | The list of Internet-Draft Shadow Directories can be accessed at |
| http://www.ietf.org/shadow.html. |  | http://www.ietf.org/shadow.html. |
| This Internet-Draft will expire on April 29, 2010. |  | This Internet-Draft will expire on September 9, 2010. |
| Copyright Notice |  | Copyright Notice |
| Copyright (c) 2009 IETF Trust and the persons identified as the |  | Copyright (c) 2010 IETF Trust and the persons identified as the |
| document authors. All rights reserved. |  | document authors. All rights reserved. |
| This document is subject to BCP 78 and the IETF Trust's Legal |  | This document is subject to BCP 78 and the IETF Trust's Legal |
| Provisions Relating to IETF Documents in effect on the date of |  | Provisions Relating to IETF Documents |
| publication of this document (http://trustee.ietf.org/license-info). |  | (http://trustee.ietf.org/license-info) in effect on the date of |
| Please review these documents carefully, as they describe your rights |  | publication of this document. Please review these documents |
| and restrictions with respect to this document. |  | carefully, as they describe your rights and restrictions with respect |
|  |  | to this document. Code Components extracted from this document must |
| Abstract |  | include Simplified BSD License text as described in Section 4.e of |
|  |  | the Trust Legal Provisions and are provided without warranty as |
| The Hypertext Transfer Protocol (HTTP) is an application-level |  | described in the BSD License. |
| protocol for distributed, collaborative, hypermedia information |  |  |
| systems. HTTP has been in use by the World Wide Web global |  |  |
| information initiative since 1990. This document is Part 7 of the |  |  |
| seven-part specification that defines the protocol referred to as |  |  |
| "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 7 defines |  |  |
| HTTP Authentication. |  |  |
| Editorial Note (To be removed by RFC Editor) |  |  |
| Discussion of this draft should take place on the HTTPBIS working |  |  |
| group mailing list (ietf-http-wg@w3.org). The current issues list is |  |  |
| at <http://tools.ietf.org/wg/httpbis/trac/report/11> and related |  |  |
| documents (including fancy diffs) can be found at |  |  |
| <http://tools.ietf.org/wg/httpbis/>. |  |  |
| The changes in this draft are summarized in Appendix C.9. |  | This document may contain material from IETF Documents or IETF |
|  |  | Contributions published or made publicly available before November |
|  |  | 10, 2008. The person(s) controlling the copyright in some of this |
|  |  | material may not have granted the IETF Trust the right to allow |
|  |  | modifications of such material outside the IETF Standards Process. |
|  |  | Without obtaining an adequate license from the person(s) controlling |
|  |  | the copyright in such materials, this document may not be modified |
|  |  | outside the IETF Standards Process, and derivative works of it may |
|  |  | not be created outside the IETF Standards Process, except to format |
|  |  | it for publication as an RFC or to translate it into languages other |
|  |  | than English. |
| Table of Contents |  | Table of Contents |
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 |  | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 |
| 1.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 4 |  | 1.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 4 |
| 1.2. Syntax Notation . . . . . . . . . . . . . . . . . . . . . 4 |  | 1.2. Syntax Notation . . . . . . . . . . . . . . . . . . . . . 4 |
| 1.2.1. Core Rules . . . . . . . . . . . . . . . . . . . . . . 5 |  | 1.2.1. Core Rules . . . . . . . . . . . . . . . . . . . . . . 5 |
| 1.2.2. ABNF Rules defined in other Parts of the |  | 1.2.2. ABNF Rules defined in other Parts of the |
| Specification . . . . . . . . . . . . . . . . . . . . 5 |  | Specification . . . . . . . . . . . . . . . . . . . . 5 |
| 2. Status Code Definitions . . . . . . . . . . . . . . . . . . . 5 |  | 2. Status Code Definitions . . . . . . . . . . . . . . . . . . . 5 |
| skipping to change at page 3, line 44 |  | skipping to change at page 3, line 44 |
| publication) . . . . . . . . . . . . . . . . . . . . 11 |  | publication) . . . . . . . . . . . . . . . . . . . . 11 |
| C.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 11 |  | C.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 11 |
| C.2. Since draft-ietf-httpbis-p7-auth-00 . . . . . . . . . . . 11 |  | C.2. Since draft-ietf-httpbis-p7-auth-00 . . . . . . . . . . . 11 |
| C.3. Since draft-ietf-httpbis-p7-auth-01 . . . . . . . . . . . 11 |  | C.3. Since draft-ietf-httpbis-p7-auth-01 . . . . . . . . . . . 11 |
| C.4. Since draft-ietf-httpbis-p7-auth-02 . . . . . . . . . . . 12 |  | C.4. Since draft-ietf-httpbis-p7-auth-02 . . . . . . . . . . . 12 |
| C.5. Since draft-ietf-httpbis-p7-auth-03 . . . . . . . . . . . 12 |  | C.5. Since draft-ietf-httpbis-p7-auth-03 . . . . . . . . . . . 12 |
| C.6. Since draft-ietf-httpbis-p7-auth-04 . . . . . . . . . . . 12 |  | C.6. Since draft-ietf-httpbis-p7-auth-04 . . . . . . . . . . . 12 |
| C.7. Since draft-ietf-httpbis-p7-auth-05 . . . . . . . . . . . 12 |  | C.7. Since draft-ietf-httpbis-p7-auth-05 . . . . . . . . . . . 12 |
| C.8. Since draft-ietf-httpbis-p7-auth-06 . . . . . . . . . . . 12 |  | C.8. Since draft-ietf-httpbis-p7-auth-06 . . . . . . . . . . . 12 |
| C.9. Since draft-ietf-httpbis-p7-auth-07 . . . . . . . . . . . 12 |  | C.9. Since draft-ietf-httpbis-p7-auth-07 . . . . . . . . . . . 12 |
|  |  | C.10. Since draft-ietf-httpbis-p7-auth-08 . . . . . . . . . . . 13 |
| Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 |  | Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 |
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 13 |  | Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 14 |
| 1. Introduction |  | 1. Introduction |
| This document defines HTTP/1.1 access control and authentication. |  | This document defines HTTP/1.1 access control and authentication. |
| Right now it includes the extracted relevant sections of RFC 2616 |  | Right now it includes the extracted relevant sections of RFC 2616 |
| with only minor changes. The intention is to move the general |  | with only minor changes. The intention is to move the general |
| framework for HTTP authentication here, as currently specified in |  | framework for HTTP authentication here, as currently specified in |
| [RFC2617], and allow the individual authentication mechanisms to be |  | [RFC2617], and allow the individual authentication mechanisms to be |
| defined elsewhere. This introduction will be rewritten when that |  | defined elsewhere. This introduction will be rewritten when that |
| occurs. |  | occurs. |
| skipping to change at page 6, line 8 |  | skipping to change at page 6, line 8 |
| [RFC2617]. |  | [RFC2617]. |
| 3. Header Field Definitions |  | 3. Header Field Definitions |
| This section defines the syntax and semantics of HTTP/1.1 header |  | This section defines the syntax and semantics of HTTP/1.1 header |
| fields related to authentication. |  | fields related to authentication. |
| 3.1. Authorization |  | 3.1. Authorization |
| The "Authorization" request-header field allows a user agent to |  | The "Authorization" request-header field allows a user agent to |
| authenticate itself with a server -- usually, but not necessary, |  | authenticate itself with a server -- usually, but not necessarily, |
| after receiving a 401 (Unauthorized) response. Its value consists of |  | after receiving a 401 (Unauthorized) response. Its value consists of |
| credentials containing information of the user agent for the realm of |  | credentials containing information of the user agent for the realm of |
| the resource being requested. |  | the resource being requested. |
| Authorization = "Authorization" ":" OWS Authorization-v |  | Authorization = "Authorization" ":" OWS Authorization-v |
| Authorization-v = credentials |  | Authorization-v = credentials |
| HTTP access authentication is described in "HTTP Authentication: |  | HTTP access authentication is described in "HTTP Authentication: |
| Basic and Digest Access Authentication" [RFC2617]. If a request is |  | Basic and Digest Access Authentication" [RFC2617]. If a request is |
| authenticated and a realm specified, the same credentials SHOULD be |  | authenticated and a realm specified, the same credentials SHOULD be |
| skipping to change at page 9, line 21 |  | skipping to change at page 9, line 21 |
| server to direct clients to discard these cached credentials. This |  | server to direct clients to discard these cached credentials. This |
| is a significant defect that requires further extensions to HTTP. |  | is a significant defect that requires further extensions to HTTP. |
| Circumstances under which credential caching can interfere with the |  | Circumstances under which credential caching can interfere with the |
| application's security model include but are not limited to: |  | application's security model include but are not limited to: |
| o Clients which have been idle for an extended period following |  | o Clients which have been idle for an extended period following |
| which the server might wish to cause the client to reprompt the |  | which the server might wish to cause the client to reprompt the |
| user for credentials. |  | user for credentials. |
| o Applications which include a session termination indication (such |  | o Applications which include a session termination indication (such |
| as a `logout' or `commit' button on a page) after which the server |  | as a "logout" or "commit" button on a page) after which the server |
| side of the application `knows' that there is no further reason |  | side of the application "knows" that there is no further reason |
| for the client to retain the credentials. |  | for the client to retain the credentials. |
| This is currently under separate study. There are a number of work- |  | This is currently under separate study. There are a number of work- |
| arounds to parts of this problem, and we encourage the use of |  | arounds to parts of this problem, and we encourage the use of |
| password protection in screen savers, idle time-outs, and other |  | password protection in screen savers, idle time-outs, and other |
| methods which mitigate the security problems inherent in this |  | methods which mitigate the security problems inherent in this |
| problem. In particular, user agents which cache credentials are |  | problem. In particular, user agents which cache credentials are |
| encouraged to provide a readily accessible mechanism for discarding |  | encouraged to provide a readily accessible mechanism for discarding |
| cached credentials under user control. |  | cached credentials under user control. |
| 6. Acknowledgments |  | 6. Acknowledgments |
| [[anchor2: TBD.]] |  | [[acks: TBD.]] |
| 7. References |  | 7. References |
| 7.1. Normative References |  | 7.1. Normative References |
| [Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |  | [Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |  | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |
| and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections, |  | and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections, |
| and Message Parsing", draft-ietf-httpbis-p1-messaging-08 |  | and Message Parsing", draft-ietf-httpbis-p1-messaging-09 |
| (work in progress), October 2009. |  | (work in progress), March 2010. |
| [Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |  | [Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |  | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |
| Nottingham, M., Ed., and J. Reschke, Ed., "HTTP/1.1, part |  | Nottingham, M., Ed., and J. Reschke, Ed., "HTTP/1.1, part |
| 6: Caching", draft-ietf-httpbis-p6-cache-08 (work in |  | 6: Caching", draft-ietf-httpbis-p6-cache-09 (work in |
| progress), October 2009. |  | progress), March 2010. |
| [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate |  | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate |
| Requirement Levels", BCP 14, RFC 2119, March 1997. |  | Requirement Levels", BCP 14, RFC 2119, March 1997. |
| [RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., |  | [RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., |
| Leach, P., Luotonen, A., and L. Stewart, "HTTP |  | Leach, P., Luotonen, A., and L. Stewart, "HTTP |
| Authentication: Basic and Digest Access Authentication", |  | Authentication: Basic and Digest Access Authentication", |
| RFC 2617, June 1999. |  | RFC 2617, June 1999. |
| [RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax |  | [RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax |
| skipping to change at page 13, line 5 |  | skipping to change at page 13, line 5 |
| None. |  | None. |
| C.9. Since draft-ietf-httpbis-p7-auth-07 |  | C.9. Since draft-ietf-httpbis-p7-auth-07 |
| Closed issues: |  | Closed issues: |
| o <http://tools.ietf.org/wg/httpbis/trac/ticket/198>: "move IANA |  | o <http://tools.ietf.org/wg/httpbis/trac/ticket/198>: "move IANA |
| registrations for optional status codes" |  | registrations for optional status codes" |
|  |  | C.10. Since draft-ietf-httpbis-p7-auth-08 |
|  |  | No significant changes. |
| Index |  | Index |
| 4 |  | 4 |
| 401 Unauthorized (status code) 5 |  | 401 Unauthorized (status code) 5 |
| 407 Proxy Authentication Required (status code) 5 |  | 407 Proxy Authentication Required (status code) 5 |
| A |  | A |
| Authorization header 6 |  | Authorization header 6 |
| G |  | G |
End of changes. 17 change blocks.
| 48 lines changed or deleted |  | 60 lines changed or added |
This html diff was produced by rfcdiff 1.36. The latest version is available from http://tools.ietf.org/tools/rfcdiff/