Re: Proposal for new HTTP 1.1 authentication scheme
Life is hard... and then you die. (Ronald.Tschalaer@psi.ch)
Sat, 13 Dec 1997 05:52:18 +0200
On 12 Dec 1997, Foteos Macrides wrote:
>
> >> What does "last symbolic element in the path field of the Request-URI"
> >> mean?
> >
> >Maybe an example is best. Assume the Request-URI is
> >"http://somewhere/the/path/index.html" then you want to to talk about all
> >URIs with a prefix of "http://somewhere/the/path/", i.e. the scheme, the
> >site component and the path component of the Request-URI minus any trailing
> >segment. I assumed "symbolic element" to refer to "/".
>
> Your example is correct, but "symbolic elements" refers to
> the "substrings in a URL path that comprise a hierarchy delimited
> by slashes".
[snip]
Thanx for the (very clear) explanation. I suppose one could just substitute
"symbolic element" by "segment".
> I'm not sure how well that would work in conjunction with
> nounce handing, and other aspects of Digest authentication which
> are more complicated than Basic, but agree with you that most
> implementors would like it to be as "drop in" as possible with
> respect to existing Basic implementations.
The nonce is not (that much of) a problem. If you previously got a
nextnonce then use that, otherwise just use the previously used nonce.
When pre-emptively sending auth info the main difference between Basic
and Digest authentication is that you have to recalculate the response
digest (and possibly entity-digest) and adjust the various parameters,
instead of just sending exact same header as you can do in Basic. So
the prefix idea works just fine with Digest.
Cheers,
Ronald