draft-ietf-httpbis-p7-auth-02.txt		draft-ietf-httpbis-p7-auth-03.txt
	Network Working Group R. Fielding, Ed.		Network Working Group R. Fielding, Ed.
	Internet-Draft Day Software		Internet-Draft Day Software
	Obsoletes: 2616 (if approved) J. Gettys		Obsoletes: 2616 (if approved) J. Gettys
	Updates: 2617 (if approved) One Laptop per Child		Updates: 2617 (if approved) One Laptop per Child
	Intended status: Standards Track J. Mogul		Intended status: Standards Track J. Mogul
	Expires: August 27, 2008 HP		Expires: December 19, 2008 HP
	H. Frystyk		H. Frystyk
	Microsoft		Microsoft
	L. Masinter		L. Masinter
	Adobe Systems		Adobe Systems
	P. Leach		P. Leach
	Microsoft		Microsoft
	T. Berners-Lee		T. Berners-Lee
	W3C/MIT		W3C/MIT
	Y. Lafon, Ed.		Y. Lafon, Ed.
	W3C		W3C
	J. Reschke, Ed.		J. Reschke, Ed.
	greenbytes		greenbytes
	February 24, 2008		June 17, 2008
	HTTP/1.1, part 7: Authentication		HTTP/1.1, part 7: Authentication
	draft-ietf-httpbis-p7-auth-02		draft-ietf-httpbis-p7-auth-03
	Status of this Memo		Status of this Memo
	By submitting this Internet-Draft, each author represents that any		By submitting this Internet-Draft, each author represents that any
	applicable patent or other IPR claims of which he or she is aware		applicable patent or other IPR claims of which he or she is aware
	have been or will be disclosed, and any of which he or she becomes		have been or will be disclosed, and any of which he or she becomes
	aware will be disclosed, in accordance with Section 6 of BCP 79.		aware will be disclosed, in accordance with Section 6 of BCP 79.
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF), its areas, and its working groups. Note that		Task Force (IETF), its areas, and its working groups. Note that
	skipping to change at page 1, line 49		skipping to change at page 1, line 49
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	The list of current Internet-Drafts can be accessed at		The list of current Internet-Drafts can be accessed at
	http://www.ietf.org/ietf/1id-abstracts.txt.		http://www.ietf.org/ietf/1id-abstracts.txt.
	The list of Internet-Draft Shadow Directories can be accessed at		The list of Internet-Draft Shadow Directories can be accessed at
	http://www.ietf.org/shadow.html.		http://www.ietf.org/shadow.html.
	This Internet-Draft will expire on August 27, 2008.		This Internet-Draft will expire on December 19, 2008.
	Copyright Notice
	Copyright (C) The IETF Trust (2008).
	Abstract		Abstract
	The Hypertext Transfer Protocol (HTTP) is an application-level		The Hypertext Transfer Protocol (HTTP) is an application-level
	protocol for distributed, collaborative, hypermedia information		protocol for distributed, collaborative, hypermedia information
	systems. HTTP has been in use by the World Wide Web global		systems. HTTP has been in use by the World Wide Web global
	information initiative since 1990. This document is Part 7 of the		information initiative since 1990. This document is Part 7 of the
	seven-part specification that defines the protocol referred to as		seven-part specification that defines the protocol referred to as
	"HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 7 defines		"HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 7 defines
	HTTP Authentication.		HTTP Authentication.
	Editorial Note (To be removed by RFC Editor)		Editorial Note (To be removed by RFC Editor)
	Discussion of this draft should take place on the HTTPBIS working		Discussion of this draft should take place on the HTTPBIS working
	group mailing list (ietf-http-wg@w3.org). The current issues list is		group mailing list (ietf-http-wg@w3.org). The current issues list is
	at <http://www.tools.ietf.org/wg/httpbis/trac/report/11> and related		at <http://www.tools.ietf.org/wg/httpbis/trac/report/11> and related
	documents (including fancy diffs) can be found at		documents (including fancy diffs) can be found at
	<http://www.tools.ietf.org/wg/httpbis/>.		<http://www.tools.ietf.org/wg/httpbis/>.
	This draft incorporates those issue resolutions that were either		The changes in this draft are summarized in Appendix B.4.
	collected in the original RFC2616 errata list
	(<http://purl.org/NET/http-errata>), or which were agreed upon on the
	mailing list between October 2006 and November 2007 (as published in
	"draft-lafon-rfc2616bis-03").
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
	1.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 4		1.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 4
	2. Notational Conventions and Generic Grammar . . . . . . . . . . 4		2. Notational Conventions and Generic Grammar . . . . . . . . . . 4
	3. Status Code Definitions . . . . . . . . . . . . . . . . . . . 5		3. Status Code Definitions . . . . . . . . . . . . . . . . . . . 5
	3.1. 401 Unauthorized . . . . . . . . . . . . . . . . . . . . . 5		3.1. 401 Unauthorized . . . . . . . . . . . . . . . . . . . . . 5
	3.2. 407 Proxy Authentication Required . . . . . . . . . . . . 5		3.2. 407 Proxy Authentication Required . . . . . . . . . . . . 5
	4. Header Field Definitions . . . . . . . . . . . . . . . . . . . 5		4. Header Field Definitions . . . . . . . . . . . . . . . . . . . 5
	4.1. Authorization . . . . . . . . . . . . . . . . . . . . . . 5		4.1. Authorization . . . . . . . . . . . . . . . . . . . . . . 5
	4.2. Proxy-Authenticate . . . . . . . . . . . . . . . . . . . . 6		4.2. Proxy-Authenticate . . . . . . . . . . . . . . . . . . . . 6
	4.3. Proxy-Authorization . . . . . . . . . . . . . . . . . . . 7		4.3. Proxy-Authorization . . . . . . . . . . . . . . . . . . . 7
	4.4. WWW-Authenticate . . . . . . . . . . . . . . . . . . . . . 7		4.4. WWW-Authenticate . . . . . . . . . . . . . . . . . . . . . 7
	5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7		5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
	6. Security Considerations . . . . . . . . . . . . . . . . . . . 7		5.1. Message Header Registration . . . . . . . . . . . . . . . 7
			6. Security Considerations . . . . . . . . . . . . . . . . . . . 8
	6.1. Authentication Credentials and Idle Clients . . . . . . . 8		6.1. Authentication Credentials and Idle Clients . . . . . . . 8
	7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 8		7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 9
	8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 8		8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 9
	8.1. Normative References . . . . . . . . . . . . . . . . . . . 8		8.1. Normative References . . . . . . . . . . . . . . . . . . . 9
	8.2. Informative References . . . . . . . . . . . . . . . . . . 9		8.2. Informative References . . . . . . . . . . . . . . . . . . 9
	Appendix A. Compatibility with Previous Versions . . . . . . . . 9		Appendix A. Compatibility with Previous Versions . . . . . . . . 9
	A.1. Changes from RFC 2616 . . . . . . . . . . . . . . . . . . 9		A.1. Changes from RFC 2616 . . . . . . . . . . . . . . . . . . 9
	Appendix B. Change Log (to be removed by RFC Editor before		Appendix B. Change Log (to be removed by RFC Editor before
	publication) . . . . . . . . . . . . . . . . . . . . 9		publication) . . . . . . . . . . . . . . . . . . . . 9
	B.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 9		B.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 10
	B.2. Since draft-ietf-httpbis-p7-auth-00 . . . . . . . . . . . 9		B.2. Since draft-ietf-httpbis-p7-auth-00 . . . . . . . . . . . 10
	B.3. Since draft-ietf-httpbis-p7-auth-01 . . . . . . . . . . . 9		B.3. Since draft-ietf-httpbis-p7-auth-01 . . . . . . . . . . . 10
			B.4. Since draft-ietf-httpbis-p7-auth-02 . . . . . . . . . . . 10
	Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10		Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
	Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 10		Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 11
	Intellectual Property and Copyright Statements . . . . . . . . . . 14		Intellectual Property and Copyright Statements . . . . . . . . . . 14
	1. Introduction		1. Introduction
	This document defines HTTP/1.1 access control and authentication.		This document defines HTTP/1.1 access control and authentication.
	Right now it includes the extracted relevant sections of RFC 2616		Right now it includes the extracted relevant sections of RFC 2616
	with only minor changes. The intention is to move the general		with only minor changes. The intention is to move the general
	framework for HTTP authentication here, as currently specified in		framework for HTTP authentication here, as currently specified in
	[RFC2617], and allow the individual authentication mechanisms to be		[RFC2617], and allow the individual authentication mechanisms to be
	defined elsewhere. This introduction will be rewritten when that		defined elsewhere. This introduction will be rewritten when that
	skipping to change at page 7, line 45		skipping to change at page 7, line 45
	The HTTP access authentication process is described in "HTTP		The HTTP access authentication process is described in "HTTP
	Authentication: Basic and Digest Access Authentication" [RFC2617].		Authentication: Basic and Digest Access Authentication" [RFC2617].
	User agents are advised to take special care in parsing the WWW-		User agents are advised to take special care in parsing the WWW-
	Authenticate field value as it might contain more than one challenge,		Authenticate field value as it might contain more than one challenge,
	or if more than one WWW-Authenticate header field is provided, the		or if more than one WWW-Authenticate header field is provided, the
	contents of a challenge itself can contain a comma-separated list of		contents of a challenge itself can contain a comma-separated list of
	authentication parameters.		authentication parameters.
	5. IANA Considerations		5. IANA Considerations
	[[anchor2: TBD.]]		5.1. Message Header Registration
			The Message Header Registry located at <http://www.iana.org/
			assignments/message-headers/message-header-index.html> should be
			updated with the permanent registrations below (see [RFC3864]):
			+---------------------+----------+----------+-------------+
			| Header Field Name | Protocol | Status | Reference |
			+---------------------+----------+----------+-------------+
			| Authorization | http | standard | Section 4.1 |
			| Proxy-Authenticate | http | standard | Section 4.2 |
			| Proxy-Authorization | http | standard | Section 4.3 |
			| WWW-Authenticate | http | standard | Section 4.4 |
			+---------------------+----------+----------+-------------+
			The change controller is: "IETF (iesg@ietf.org) - Internet
			Engineering Task Force".
	6. Security Considerations		6. Security Considerations
	This section is meant to inform application developers, information		This section is meant to inform application developers, information
	providers, and users of the security limitations in HTTP/1.1 as		providers, and users of the security limitations in HTTP/1.1 as
	described by this document. The discussion does not include		described by this document. The discussion does not include
	definitive solutions to the problems revealed, though it does make		definitive solutions to the problems revealed, though it does make
	some suggestions for reducing security risks.		some suggestions for reducing security risks.
	6.1. Authentication Credentials and Idle Clients		6.1. Authentication Credentials and Idle Clients
	skipping to change at page 8, line 36		skipping to change at page 9, line 7
	This is currently under separate study. There are a number of work-		This is currently under separate study. There are a number of work-
	arounds to parts of this problem, and we encourage the use of		arounds to parts of this problem, and we encourage the use of
	password protection in screen savers, idle time-outs, and other		password protection in screen savers, idle time-outs, and other
	methods which mitigate the security problems inherent in this		methods which mitigate the security problems inherent in this
	problem. In particular, user agents which cache credentials are		problem. In particular, user agents which cache credentials are
	encouraged to provide a readily accessible mechanism for discarding		encouraged to provide a readily accessible mechanism for discarding
	cached credentials under user control.		cached credentials under user control.
	7. Acknowledgments		7. Acknowledgments
	TBD.		[[anchor2: TBD.]]
	8. References		8. References
	8.1. Normative References		8.1. Normative References
	[Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,		[Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
	Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,		Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
	and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections,		and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections,
	and Message Parsing", draft-ietf-httpbis-p1-messaging-02		and Message Parsing", draft-ietf-httpbis-p1-messaging-03
	(work in progress), February 2008.		(work in progress), June 2008.
	[Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,		[Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
	Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,		Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
	and J. Reschke, Ed., "HTTP/1.1, part 6: Caching",		and J. Reschke, Ed., "HTTP/1.1, part 6: Caching",
	draft-ietf-httpbis-p6-cache-02 (work in progress),		draft-ietf-httpbis-p6-cache-03 (work in progress),
	February 2008.		June 2008.
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, March 1997.		Requirement Levels", BCP 14, RFC 2119, March 1997.
	[RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S.,		[RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S.,
	Leach, P., Luotonen, A., and L. Stewart, "HTTP		Leach, P., Luotonen, A., and L. Stewart, "HTTP
	Authentication: Basic and Digest Access Authentication",		Authentication: Basic and Digest Access Authentication",
	RFC 2617, June 1999.		RFC 2617, June 1999.
	8.2. Informative References		8.2. Informative References
	[RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,		[RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,
	Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext		Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext
	Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.		Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.
			[RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration
			Procedures for Message Header Fields", BCP 90, RFC 3864,
			September 2004.
	Appendix A. Compatibility with Previous Versions		Appendix A. Compatibility with Previous Versions
	A.1. Changes from RFC 2616		A.1. Changes from RFC 2616
	Appendix B. Change Log (to be removed by RFC Editor before publication)		Appendix B. Change Log (to be removed by RFC Editor before publication)
	B.1. Since RFC2616		B.1. Since RFC2616
	Extracted relevant partitions from [RFC2616].		Extracted relevant partitions from [RFC2616].
	skipping to change at page 10, line 5		skipping to change at page 10, line 27
	Ongoing work on ABNF conversion		Ongoing work on ABNF conversion
	(<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36>):		(<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36>):
	o Explicitly import BNF rules for "challenge" and "credentials" from		o Explicitly import BNF rules for "challenge" and "credentials" from
	RFC2617.		RFC2617.
	o Add explicit references to BNF syntax and rules imported from		o Add explicit references to BNF syntax and rules imported from
	other parts of the specification.		other parts of the specification.
			B.4. Since draft-ietf-httpbis-p7-auth-02
			Ongoing work on IANA Message Header Registration
			(<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/40>):
			o Reference RFC 3984, and update header registrations for headers
			defined in this document.
	Index		Index
	4		4
	401 Unauthorized (status code) 5		401 Unauthorized (status code) 5
	407 Proxy Authentication Required (status code) 5		407 Proxy Authentication Required (status code) 5
	A		A
	Authorization header 5		Authorization header 5
	G		G
	skipping to change at page 14, line 44		skipping to change at line 569
	attempt made to obtain a general license or permission for the use of		attempt made to obtain a general license or permission for the use of
	such proprietary rights by implementers or users of this		such proprietary rights by implementers or users of this
	specification can be obtained from the IETF on-line IPR repository at		specification can be obtained from the IETF on-line IPR repository at
	http://www.ietf.org/ipr.		http://www.ietf.org/ipr.
	The IETF invites any interested party to bring to its attention any		The IETF invites any interested party to bring to its attention any
	copyrights, patents or patent applications, or other proprietary		copyrights, patents or patent applications, or other proprietary
	rights that may cover technology that may be required to implement		rights that may cover technology that may be required to implement
	this standard. Please address the information to the IETF at		this standard. Please address the information to the IETF at
	ietf-ipr@ietf.org.		ietf-ipr@ietf.org.
	Acknowledgment
	Funding for the RFC Editor function is provided by the IETF
	Administrative Support Activity (IASA).
End of changes. 16 change blocks.
	27 lines changed or deleted		49 lines changed or added
This html diff was produced by rfcdiff 1.34. The latest version is available from http://tools.ietf.org/tools/rfcdiff/