Source: https://www.greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-auth-26.html
Timestamp: 2018-11-16 11:50:41
Document Index: 583641474

Matched Legal Cases: ['art1', 'art2', 'art6', 'art1', 'art1', 'art2', 'art1', 'art6']

HTTP provides a general framework for access control and authentication, via an extensible set of challenge-response authentication schemes, which can be used by a server to challenge a client request and by a client to provide authentication information. This document defines HTTP/1.1 authentication in terms of the architecture defined in [Part1] , including the general framework previously described in RFC 2617 and the related fields and status codes previously defined in RFC 2616 .¶
A server that receives valid credentials which are not adequate to gain access ought to respond with the 403 (Forbidden) status code (Section 6.5.3 of [Part2] ).¶
The 407 (Proxy Authentication Required) status code is similar to 401 (Unauthorized), but indicates that the client needs to authenticate itself in order to use a proxy. The proxy MUST send a Proxy-Authenticate header field (Section 4.3) containing a challenge applicable to that proxy for the target resource. The client MAY repeat the request with a new or replaced Proxy-Authorization header field (Section 4.4).¶
A proxy forwarding a request MUST NOT modify any Authorization fields in that request. See Section 3.2 of [Part6] for details of and requirements pertaining to handling of the Authorization field by HTTP caches.¶
The "Proxy-Authenticate" header field consists of at least one challenge that indicates the authentication scheme(s) and parameters applicable to the proxy for this effective request URI (Section 5.5 of [Part1] ). A proxy MUST send at least one Proxy-Authenticate header field in each 407 (Proxy Authentication Required) response that it generates.¶
This section is meant to inform developers, information providers, and users of known security concerns specific to HTTP authentication. More general security considerations are addressed in HTTP messaging [Part1] and semantics [Part2] .¶
HTTP depends on the security properties of the underlying transport or session-level connection to provide confidential transmission of header fields. In other words, if a server limits access to authenticated users using this framework, the server needs to ensure that the connection is properly secured in accordance with the nature of the authentication scheme used. For example, services that depend on individual user authentication often require a connection to be secured with TLS ("Transport Layer Security", [RFC5246] ) prior to exchanging any credentials.¶
<http://tools.ietf.org/wg/httpbis/trac/ticket/539>: "mention TLS vs plain text passwords or dict attacks?"
Part1 1, 1.1, 1.2, 2.2, 4.3, 5.1.2, 6, 7, 8.1, B, B, B, B, B, C
Part6 4.2, 5.1.2, 5.1.2, 8.1