Subject: Re: [http-auth] rev'd charter-like text

From: Paul Leach <[email-masked]>
Date: Tue, 13 Nov 2012 23:04:44 +0000

The referenced section makes it clear that clients are supposed to handle www-auth for more than one scheme; it doesn’t explicitly say that they need to handle multiple instances of the same scheme.

Even if it did, it doesn’t help if deployed clients all break when they get more than one.

A quick experiment could be done -- see what browsers do when offered the MD5 and MD5-sess variant of Digest.

OTOH, all the issues mentioned so far could be avoided by creating a new scheme which is just like Digest except for better hash and i18n.

PJL

Sent from Windows Mail

From: Shekh-Yusef, Rifaat (Rifaat)
Sent: ‎November‎ ‎12‎, ‎2012 ‎4‎:‎52‎ ‎PM
To: Paul Hoffman
CC: Mark Nottingham, [email-masked]
Subject: Re: [http-auth] rev'd charter-like text

Clarification:
Take a look at RFC2617, section 1.2, page 3, second paragraph from the bottom, that starts with "NOTE:..."

Sent from my iPhone

On 2012-11-12, at 7:45 PM, "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]> wrote:

> Thanks for your feedback Paul.
> 
> Take a look at Section 1.2, second paragraph from the bottom; it starts with "NOTE: User agent...".
> 
> It clearly states that the client must be ready to handle multiple headers. Does that address your concern? Do you have any other concerns?
> 
> Regards,
> Rifaat
> 
> 
> Sent from my iPhone
> 
> On 2012-11-12, at 7:14 PM, "Paul Hoffman" <[email-masked]> wrote:
> 
>> On Nov 12, 2012, at 2:37 PM, "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]> wrote:
>> 
>>> Can you please elaborate on what "incompatible changes" you see in the draft?
>> 
>> The fact that you propose that people send multiple "WWW-Authenticate: Digest" headers. That looks to be prohibited by RFC 2617 (unless I'm badly misreading that spec).
>> 
>>> Our intention is to stay compatible with the existing mechanism, and we would be ready to address any incompatibility issues that we might have missed.
>> 
>> If you want to change your proposal to "pick one digest algorithm and use it", that would bring it into line with RFC 2617.
>> 
>> --Paul Hoffman
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
_______________________________________________
http-auth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/http-auth

---

From: "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]>
Date: Sat, 17 Nov 2012 16:50:40 +0000

Hi Paul,

I did some experiments with Chrome and Internet Explorer.
It seems that both know how to handle multiple WWW-Authenticate headers with the same scheme, and both give preference to the header that appears first.

The only difference is when I include a scheme that is not supported by the browser.
In the case of Chrome, it seems that the browser ignores the schemes it does not understand and picks the first one it does.
In the case of IE, it reverts back to Basic scheme.

Here are the tests:

Chrome
======

HTTP/1.0 401 Unauthorized Access Denied
Server: Intoto Http Server v1.0
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5-sess"
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5"
Content-type: text/html
Pragma: no-cache
Connection: Close
Content-Length: 146

GET / HTTP/1.1
Host: 192.168.1.1
Proxy-Connection: keep-alive
Authorization: Digest username="admin", realm="[email-masked]<mailto:[email-masked]>", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", uri="/", algorithm=MD5-sess, response="6e7aecee2059dad9cdd2ad443d7b4279", opaque="5ccc069c403ebaf9f0171e9517f40e41", qop=auth, nc=00000001, cnonce="6badc25501c9e7fc"
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

HTTP/1.0 401 Unauthorized Access Denied
Server: Intoto Http Server v1.0
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5"
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5-sess"
Content-type: text/html
Pragma: no-cache
Connection: Close
Content-Length: 146

GET / HTTP/1.1
Host: 192.168.1.1
Proxy-Connection: keep-alive
Authorization: Digest username="admin", realm="[email-masked]<mailto:[email-masked]>", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", uri="/", algorithm=MD5, response="aea1d2a3daa018b619648bc42c4a4e7a", opaque="5ccc069c403ebaf9f0171e9517f40e41", qop=auth, nc=00000001, cnonce="46b49ffc5ce29596"
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

HTTP/1.0 401 Unauthorized Access Denied
Server: Intoto Http Server v1.0
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="bla-bla"
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="SHA-256"
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5-sess"
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5"
Content-type: text/html
Pragma: no-cache
Connection: Close
Content-Length: 146

GET / HTTP/1.1
Host: 192.168.1.1
Proxy-Connection: keep-alive
Authorization: Digest username="admin", realm="[email-masked]<mailto:[email-masked]>", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", uri="/", algorithm=MD5-sess, response="61ef90ba90aa7e4f58c824d72cc1b3d5", opaque="5ccc069c403ebaf9f0171e9517f40e41", qop=auth, nc=00000001, cnonce="d5bdcb1d78ce3a4d"
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Internet Explorer
=============

HTTP/1.0 401 Unauthorized Access Denied
Server: Intoto Http Server v1.0
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5-sess"
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5"
Content-type: text/html
Pragma: no-cache
Connection: Close
Content-Length: 146

GET / HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Host: 192.168.1.1
Authorization: Digest username="admin",realm="[email-masked]<mailto:[email-masked]>",nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",uri="/",cnonce="f28481acc0ae6b21c5c712f50ef754b8",nc=00000001,algorithm=MD5-sess,response="e42dbb1b5ac84b496cb785d492ff6492",qop="auth",opaque="5ccc069c403ebaf9f0171e9517f40e41"

HTTP/1.0 401 Unauthorized Access Denied
Server: Intoto Http Server v1.0
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5"
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5-sess"
Content-type: text/html
Pragma: no-cache
Connection: Close
Content-Length: 146

GET / HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Host: 192.168.1.1
Authorization: Digest username="admin",realm="[email-masked]<mailto:[email-masked]>",nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",uri="/",cnonce="216c54d6365beb6598ff9f03207477d8",nc=00000001,algorithm=MD5,response="c972bbc69e2e0a16ee4f8419121cb17f",qop="auth",opaque="5ccc069c403ebaf9f0171e9517f40e41"

HTTP/1.0 401 Unauthorized Access Denied
Server: Intoto Http Server v1.0
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="bla-bla"
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="SHA-256"
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5-sess"
WWW-Authenticate: Digest realm="[email-masked]<mailto:[email-masked]>", qop="auth,auth-int", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41", algorithm="MD5"
Content-type: text/html
Pragma: no-cache
Connection: Close
Content-Length: 146

HTTP/1.0 401 Unauthorized Access Denied
Server: Intoto Http Server v1.0
WWW-Authenticate: Basic realm="WRT54G"
Content-type: text/html
Pragma: no-cache
Connection: Close

Regards,
Rifaat

From: Paul Leach [mailto:[email-masked]]
Sent: Tuesday, November 13, 2012 6:05 PM
To: Paul Hoffman; Shekh-Yusef, Rifaat (Rifaat)
Cc: Mark Nottingham; [email-masked]<mailto:[email-masked]>
Subject: RE: [http-auth] rev'd charter-like text

PJL

Sent from Windows Mail

From: Shekh-Yusef, Rifaat (Rifaat)
Sent: ‎November‎ ‎12‎, ‎2012 ‎4‎:‎52‎ ‎PM
To: Paul Hoffman
CC: Mark Nottingham, [email-masked]<mailto:[email-masked]>
Subject: Re: [http-auth] rev'd charter-like text

Clarification:

Sent from my iPhone

On 2012-11-12, at 7:45 PM, "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]<mailto:[email-masked]>> wrote:

> On 2012-11-12, at 7:14 PM, "Paul Hoffman" <[email-masked]<mailto:[email-masked]>> wrote:
>
>> On Nov 12, 2012, at 2:37 PM, "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]<mailto:[email-masked]>> wrote:
>>
> [email-masked]<mailto:[email-masked]>
_______________________________________________
http-auth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/http-auth

---

From: "Shekh-Yusef, Rifaat (Rifaat)" <[email-masked]>
Date: Sat, 17 Nov 2012 16:54:59 +0000

Sorry, in the second paragraph, I meant to say that the difference is “when I include an *algorithm* that is not supported”, not a scheme.

Regards,
Rifaat

From: [email-masked] [mailto:[email-masked]] On Behalf Of Shekh-Yusef, Rifaat (Rifaat)
Sent: Saturday, November 17, 2012 11:51 AM
To: Paul Leach; Paul Hoffman
Cc: Mark Nottingham; [email-masked]
Subject: Re: [http-auth] rev'd charter-like text

Hi Paul,

Here are the tests:

Chrome
======

GET / HTTP/1.1
Host: 192.168.1.1

GET / HTTP/1.1
Host: 192.168.1.1

GET / HTTP/1.1
Host: 192.168.1.1

Internet Explorer
=============

GET / HTTP/1.1

GET / HTTP/1.1

Regards,
Rifaat

PJL

Sent from Windows Mail

Clarification:

Sent from my iPhone