Subject: [http-auth] HTTP Integrity/Session header -02

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 14 Nov 2012 20:36:54 -0500

The new draft is at:

http://tools.ietf.org/html/draft-hallambaker-httpintegrity-02

Just as I was completing this draft, it occurred to me that what I should
probably do is to rename the header 'Session' since the purpose of the
header is to carry the authentication session continuation information.

To provide some context for what the header is designed to do, I have added
a brief description of a simple in-band HTTP key exchange that addresses
the most egregious shortcomings of HTTP bearer token cookies. This is only
a sketch for illustrative purposes though and it needs to be fleshed out
properly in a separate draft. A proper draft would have to address when/how
to use WWW-Authenticate headers etc.

The idea behind this header is that an authentication scheme has three
parts: credential management, session management and session continuation.
While there are good reasons to have variations in the first two, the third
is an area which multiple authentication schemes could share - at least in
principle. This is designed to address the third part of the problem,
session continuation.

As far as moving forward with the draft goes, the HTTPbis and WEBSEC WGs
need to be included in the discussions regardless of where the discussion
ends up.

Using this approach in a Web Services context is MUCH simpler than
SOAP/WS-Security or any similar scheme based on JSON Signature. Putting the
signature in the HTTP header eliminates the need to identify which parts of
the content are being signed and which parts are the signature.

The main drawback to this approach is that some HTTP implementations have
botched the chunked encoding and cannot support footers. This is not an
issue for my Web Services and probably not for most others. In fact the
type of Web service where the difference would be significant is precisely
the type of Web Service that HTTP/2.0 would be ideal for.

-- 
Website: http://hallambaker.com/

---

From: "Martin J. Dürst" <[email-masked]>
Date: Thu, 15 Nov 2012 12:40:37 +0900

Hello Phillip,

> header is to carry the authentication session continuation information.

Can you make that something slightly longer/more descriptive just in 
case there are other proposals in a similar direction, or changes later 
in the game that require a new header name, or people with slightly or 
strongly different ideas of what a session?

Regards,   Martin.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 14 Nov 2012 22:47:35 -0500

AuthSession?

Note that going further than Auth to Authentication is probably
inappropriate since the session identifier typically conflates
Authentication and Authorization.

On Wed, Nov 14, 2012 at 10:40 PM, "Martin J. Dürst"
<[email-masked]>wrote:

>> http://tools.ietf.org/html/**draft-hallambaker-**httpintegrity-02<http://tools.ietf.org/html/draft-hallambaker-httpintegrity-02>
>>
> Can you make that something slightly longer/more descriptive just in case
> there are other proposals in a similar direction, or changes later in the
> game that require a new header name, or people with slightly or strongly
> different ideas of what a session?
>
> Regards,   Martin.
>

---

From: "Martin J. Dürst" <[email-masked]>
Date: Thu, 15 Nov 2012 13:07:27 +0900

> AuthSession?

Yes, exactly something like this.

> Authentication and Authorization.

Agreed.   Regards,   Martin.