Subject: Re: [Fwd: Aurthorization & Proxy-Authorization URIs]

From: Henning Schulzrinne <[email-masked]>
Date: Fri, 25 Feb 2000 19:54:39 -0500

Jonathan Rosenberg wrote:
> 
> ?? I guess the quotes shouldn't be there according to the current BNF,
> but it might make parsing harder.?

Since the digest authentication mechanism attempts to follow RFC 2617
(obviously, 2617 postdates 2543, but it will be the normative reference
in the next round), request-uri is indeed defined without being a quoted
string, even though the uri is not a token. (Unless you put an unescaped
comma into the URI, there shouldn't be delineation problems. But we had
this discussion in another context, where it became clear that URIs can
indeed contain commas.) Some parsers allow all parameters to be either
tokens or quoted strings, since that's easiest and never wrong.

Unfortunately, RFC 2617 itself is not consistent. In the BNF (3.2.2),
it's without quotes, in the example (Section 3.5), it shows up *with*
quotes. I guess we need to contact the RFC 2617 authors to find out what
people really do and what they intended. Another instance of URIs (in
WWW-Authenticate) is always with quotes.

Thus, the confusion is more fundamental.

> 
> Subject: Aurthorization & Proxy-Authorization URIs
> Date: Mon, 21 Feb 2000 14:53:22 -0500
> From: Linden deCarmo <[email-masked]>
> To: [email-masked]
> 
> The BNF for digest-uri defined by "HTTP Authentication: Basic and Digest
> Access Authentication" for use in Aurthorization & Proxy-Authorization
> headers is:
> 
> digest-uri       = "uri" "=" digest-uri-value
> digest-uri-value = request-uri   ; As specified by HTTP/1.1
> 
> RFC2543, updates this definition to be:
> 
>         2.   The BNF for digest-uri-value is:
> 
> digest-uri-value  =  Request-URI ; a defined in Section 4.3
> 
> Yet, all the sample call flows for the uri parameters for the Aurthorization
> & Proxy-Authorization headers that I've seen (i.e. SIP Telephony Service
> Examples With Call Flows)
> enclose the uri parameter in quotes (i.e. a quoted string) just like the
> HTTP docs:
> 
> uri="sip:xxx.yyyy.com"
> 
> Syntacically, I can't see how this is possible.  Am I wrong?  If so, could
> someone point out the relevant section that explains how this is possible?
> 
> Thank you.
> 
> Linden deCarmo
> Netspeak Corporation
> 902 Clint Moore Road
> Suite 104
> Boca Raton, FL 33487