Subject: [OAUTH-WG] What to do about 'realm'

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 27 Jun 2010 18:51:46 -0700

Over the past year many people expressed concerns about the use of the 'realm' WWW-Authenticate header parameter. The parameter is defined in RFC 2617 as required, and is allowed to have scheme-specific structure.

We have a few options:

1. Leave it as required under the definition of RFC 2617 (i.e. provide no help, developers will need to ready 2617 and figure out what to do with it).
2. Update 2617 to remove the requirement - this is not going to be easy or possible to predict success.
3. Provide specific guidance as to what to do with the realm parameter.
4. Something else.

Comments?

EHL

---

From: Dick Hardt <[email-masked]>
Date: Sun, 27 Jun 2010 22:37:36 -0700

I vote for (3) unless a good (4) is suggested.

On 2010-06-27, at 6:51 PM, Eran Hammer-Lahav wrote:

> Over the past year many people expressed concerns about the use of the ‘realm’ WWW-Authenticate header parameter. The parameter is defined in RFC 2617 as required, and is allowed to have scheme-specific structure.
>  
> We have a few options:
>  
> 2. Update 2617 to remove the requirement – this is not going to be easy or possible to predict success.
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Lukas Rosenstock <[email-masked]>
Date: Mon, 28 Jun 2010 09:14:08 +0200

+1

2010/6/28 Dick Hardt <[email-masked]>:
> Over the past year many people expressed concerns about the use of the
> ‘realm’ WWW-Authenticate header parameter. The parameter is defined in RFC
> 2617 as required, and is allowed to have scheme-specific structure.
>
> We have a few options:
>
> 1. Leave it as required under the definition of RFC 2617 (i.e. provide no
> help, developers will need to ready 2617 and figure out what to do with it).

-- 
http://lukasrosenstock.net/

---

From: Pid <[email-masked]>
Date: Mon, 28 Jun 2010 08:43:13 +0100

> I vote for (3) unless a good (4) is suggested.

Ditto.

p

>> ‘realm’ WWW-Authenticate header parameter. The parameter is defined in
>> RFC 2617 as required, and is allowed to have scheme-specific structure.
>>  
>> We have a few options:
>>  
>> 1. Leave it as required under the definition of RFC 2617 (i.e. provide
>> no help, developers will need to ready 2617 and figure out what to do
>> with it).
>> [email-masked] <mailto:[email-masked]>

---

From: "William Mills" <[email-masked]>
Date: Mon, 28 Jun 2010 09:29:44 -0700

#3 +1

> > 'realm' WWW-Authenticate header parameter. The parameter is 
> defined in 
> > RFC
> > no help, developers will need to ready 2617 and figure out 
> what to do with it).

---

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 28 Jun 2010 20:07:46 +0200

+1

Am 28.06.2010 07:37, schrieb Dick Hardt:
>> Over the past year many people expressed concerns about the use of 
>> the ‘realm’ WWW-Authenticate header parameter. The parameter is 
>> defined in RFC 2617 as required, and is allowed to have 
>> scheme-specific structure.
>> We have a few options:
>> 1. Leave it as required under the definition of RFC 2617 (i.e. 
>> provide no help, developers will need to ready 2617 and figure out 
>> what to do with it).

---

From: Yaron Goland <[email-masked]>
Date: Mon, 28 Jun 2010 22:12:52 +0000

+1 (for #3->#4)

From: [email-masked] [mailto:[email-masked]] On Behalf Of Torsten Lodderstedt
Sent: Monday, June 28, 2010 11:08 AM
To: Dick Hardt
Cc: OAuth WG ([email-masked])
Subject: Re: [OAUTH-WG] What to do about 'realm'

+1

We have a few options:

Comments?

EHL
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

OAuth mailing list

[email-masked]<mailto:[email-masked]>