>So here's a proposal: if an HTTP/1.1 agent (client or server) supports >Basic, it must also support Digest. Authentication support remains >optional, but it's all or none. This sounds right to me as well. If you support some authentication, you must support good authentication, but you can also support Basic for obvious historical reasons. --Paul Hoffman --Internet Mail Consortium