Source: https://trac.ietf.org/trac/httpbis/browser/draft-ietf-httpbis/01/p7-auth.html?rev=2640
Timestamp: 2020-07-14 04:38:56
Document Index: 50096387

Matched Legal Cases: ['art 7', 'art6', 'art6', 'art 6', 'art6', 'art6', 'art6', 'art6', 'art6']

p7-auth.html in draft-ietf-httpbis/01 – Hypertext Transfer Protocol Wiki
source: draft-ietf-httpbis/01/p7-auth.html @ 2640
Last change on this file since 2640 was 1099, checked in by julian.reschke@…, 10 years ago
<meta name="dct.identifier" content="urn:ietf:id:draft-ietf-httpbis-p7-auth-01">
<meta name="dct.issued" scheme="ISO8601" content="2008-01-12">
<td class="left">Expires: July 15, 2008</td>
<td class="right">January 12, 2008</td>
<p class="title">HTTP/1.1, part 7: Authentication<br><span class="filename">draft-ietf-httpbis-p7-auth-01</span></p>
<li>2.&nbsp;&nbsp;&nbsp;<a href="#rfc.section.2">Status Code Definitions</a><ul>
<li>2.1&nbsp;&nbsp;&nbsp;<a href="#status.401">401 Unauthorized</a></li>
<li>2.2&nbsp;&nbsp;&nbsp;<a href="#status.407">407 Proxy Authentication Required</a></li>
<li>3.1&nbsp;&nbsp;&nbsp;<a href="#header.authorization">Authorization</a></li>
<li>3.2&nbsp;&nbsp;&nbsp;<a href="#header.proxy-authenticate">Proxy-Authenticate</a></li>
<li>3.3&nbsp;&nbsp;&nbsp;<a href="#header.proxy-authorization">Proxy-Authorization</a></li>
<li>3.4&nbsp;&nbsp;&nbsp;<a href="#header.www-authenticate">WWW-Authenticate</a></li>
<li>4.&nbsp;&nbsp;&nbsp;<a href="#IANA.considerations">IANA Considerations</a></li>
<li>5.&nbsp;&nbsp;&nbsp;<a href="#security.considerations">Security Considerations</a><ul>
<li>5.1&nbsp;&nbsp;&nbsp;<a href="#auth.credentials.and.idle.clients">Authentication Credentials and Idle Clients</a></li>
<li>6.&nbsp;&nbsp;&nbsp;<a href="#ack">Acknowledgments</a></li>
<li>7.&nbsp;&nbsp;&nbsp;<a href="#rfc.references">References</a><ul>
<li>7.1&nbsp;&nbsp;&nbsp;<a href="#rfc.references.1">Normative References</a></li>
<li>7.2&nbsp;&nbsp;&nbsp;<a href="#rfc.references.2">Informative References</a></li>
<li>B.&nbsp;&nbsp;&nbsp;<a href="#rfc.section.B">Change Log (to be removed by RFC Editor before publication)</a><ul>
<div id="rfc.iref."></div>
access authentication is explained in "HTTP Authentication: Basic and Digest Access Authentication" <a href="#RFC2617" id="rfc.xref.RFC2617.3"><cite title="HTTP Authentication: Basic and Digest Access Authentication">[RFC2617]</cite></a>.
<div id="rfc.iref.1"></div>
proxy <em class="bcp14">MUST</em> return a Proxy-Authenticate header field (<a href="#header.proxy-authenticate" id="rfc.xref.header.proxy-authenticate.1" title="Proxy-Authenticate">Section&nbsp;3.2</a>) containing a challenge applicable to the proxy for the requested resource. The client <em class="bcp14">MAY</em> repeat the request with a suitable Proxy-Authorization header field (<a href="#header.proxy-authorization" id="rfc.xref.header.proxy-authorization.1" title="Proxy-Authorization">Section&nbsp;3.3</a>). HTTP access authentication is explained in "HTTP Authentication: Basic and Digest Access Authentication" <a href="#RFC2617" id="rfc.xref.RFC2617.4"><cite title="HTTP Authentication: Basic and Digest Access Authentication">[RFC2617]</cite></a>.
<p id="rfc.section.3.1.p.1">A user agent that wishes to authenticate itself with a server-- usually, but not necessarily, after receiving a 401 response--does
<div id="rfc.figure.u.1"></div><pre class="inline"><span id="rfc.iref.g.1"></span> Authorization = "Authorization" ":" credentials
</pre><p id="rfc.section.3.1.p.3">HTTP access authentication is described in "HTTP Authentication: Basic and Digest Access Authentication" <a href="#RFC2617" id="rfc.xref.RFC2617.5"><cite title="HTTP Authentication: Basic and Digest Access Authentication">[RFC2617]</cite></a>. If a request is authenticated and a realm specified, the same credentials <em class="bcp14">SHOULD</em> be valid for all other requests within this realm (assuming that the authentication scheme itself does not require otherwise,
<p id="rfc.section.3.1.p.4">When a shared cache (see <a href="p6-cache.html#shared.and.non-shared.caches" title="Shared and Non-Shared Caches">Section 8</a> of <a href="#Part6" id="rfc.xref.Part6.1"><cite title="HTTP/1.1, part 6: Caching">[Part6]</cite></a>) receives a request containing an Authorization field, it <em class="bcp14">MUST NOT</em> return the corresponding response as a reply to any other request, unless one of the following specific exceptions holds:
<p id="rfc.section.3.2.p.1">The Proxy-Authenticate response-header field <em class="bcp14">MUST</em> be included as part of a 407 (Proxy Authentication Required) response. The field value consists of a challenge that indicates
<div id="rfc.figure.u.2"></div><pre class="inline"><span id="rfc.iref.g.2"></span> Proxy-Authenticate = "Proxy-Authenticate" ":" 1#challenge
</pre><p id="rfc.section.3.2.p.3">The HTTP access authentication process is described in "HTTP Authentication: Basic and Digest Access Authentication" <a href="#RFC2617" id="rfc.xref.RFC2617.6"><cite title="HTTP Authentication: Basic and Digest Access Authentication">[RFC2617]</cite></a>. Unlike WWW-Authenticate, the Proxy-Authenticate header field applies only to the current connection and <em class="bcp14">SHOULD NOT</em> be passed on to downstream clients. However, an intermediate proxy might need to obtain its own credentials by requesting
<p id="rfc.section.3.3.p.1">The Proxy-Authorization request-header field allows the client to identify itself (or its user) to a proxy which requires
<div id="rfc.figure.u.3"></div><pre class="inline"><span id="rfc.iref.g.3"></span> Proxy-Authorization = "Proxy-Authorization" ":" credentials
</pre><p id="rfc.section.3.3.p.3">The HTTP access authentication process is described in "HTTP Authentication: Basic and Digest Access Authentication" <a href="#RFC2617" id="rfc.xref.RFC2617.7"><cite title="HTTP Authentication: Basic and Digest Access Authentication">[RFC2617]</cite></a>. Unlike Authorization, the Proxy-Authorization header field applies only to the next outbound proxy that demanded authentication
<p id="rfc.section.3.4.p.1">The WWW-Authenticate response-header field <em class="bcp14">MUST</em> be included in 401 (Unauthorized) response messages. The field value consists of at least one challenge that indicates the
<div id="rfc.figure.u.4"></div><pre class="inline"><span id="rfc.iref.g.4"></span> WWW-Authenticate = "WWW-Authenticate" ":" 1#challenge
</pre><p id="rfc.section.3.4.p.3">The HTTP access authentication process is described in "HTTP Authentication: Basic and Digest Access Authentication" <a href="#RFC2617" id="rfc.xref.RFC2617.8"><cite title="HTTP Authentication: Basic and Digest Access Authentication">[RFC2617]</cite></a>. User agents are advised to take special care in parsing the WWW-Authenticate field value as it might contain more than one
<li>401 Unauthorized (status code)&nbsp;&nbsp;<a href="#rfc.iref."><b>2.1</b></a></li>
<li>407 Proxy Authentication Required (status code)&nbsp;&nbsp;<a href="#rfc.iref.1"><b>2.2</b></a></li>
<li>Authorization header&nbsp;&nbsp;<a href="#rfc.xref.header.authorization.1">2.1</a>, <a href="#rfc.iref.a.1"><b>3.1</b></a></li>
<li><tt>Authorization</tt>&nbsp;&nbsp;<a href="#rfc.iref.g.1"><b>3.1</b></a></li>
<li><tt>Proxy-Authenticate</tt>&nbsp;&nbsp;<a href="#rfc.iref.g.2"><b>3.2</b></a></li>
<li><tt>Proxy-Authorization</tt>&nbsp;&nbsp;<a href="#rfc.iref.g.3"><b>3.3</b></a></li>
<li><tt>WWW-Authenticate</tt>&nbsp;&nbsp;<a href="#rfc.iref.g.4"><b>3.4</b></a></li>
<li>Authorization&nbsp;&nbsp;<a href="#rfc.xref.header.authorization.1">2.1</a>, <a href="#rfc.iref.h.1"><b>3.1</b></a></li>
<li>Proxy-Authenticate&nbsp;&nbsp;<a href="#rfc.xref.header.proxy-authenticate.1">2.2</a>, <a href="#rfc.iref.h.2"><b>3.2</b></a></li>
<li>Proxy-Authorization&nbsp;&nbsp;<a href="#rfc.xref.header.proxy-authorization.1">2.2</a>, <a href="#rfc.iref.h.3"><b>3.3</b></a></li>
<li>WWW-Authenticate&nbsp;&nbsp;<a href="#rfc.xref.header.www-authenticate.1">2.1</a>, <a href="#rfc.iref.h.4"><b>3.4</b></a></li>
<li><em>Part6</em>&nbsp;&nbsp;<a href="#rfc.xref.Part6.1">3.1</a>, <a href="#Part6"><b>7.1</b></a><ul>
<li><em>Section 8</em>&nbsp;&nbsp;<a href="#rfc.xref.Part6.1">3.1</a></li>
<li>Proxy-Authenticate header&nbsp;&nbsp;<a href="#rfc.xref.header.proxy-authenticate.1">2.2</a>, <a href="#rfc.iref.p.1"><b>3.2</b></a></li>
<li>Proxy-Authorization header&nbsp;&nbsp;<a href="#rfc.xref.header.proxy-authorization.1">2.2</a>, <a href="#rfc.iref.p.2"><b>3.3</b></a></li>
<li><em>RFC2119</em>&nbsp;&nbsp;<a href="#rfc.xref.RFC2119.1">1.1</a>, <a href="#RFC2119"><b>7.1</b></a></li>
<li><em>RFC2616</em>&nbsp;&nbsp;<a href="#rfc.xref.RFC2616.1">1</a>, <a href="#RFC2616"><b>7.2</b></a>, <a href="#rfc.xref.RFC2616.2">B.1</a></li>
<li><em>RFC2617</em>&nbsp;&nbsp;<a href="#rfc.xref.RFC2617.1">1</a>, <a href="#rfc.xref.RFC2617.2">1</a>, <a href="#rfc.xref.RFC2617.3">2.1</a>, <a href="#rfc.xref.RFC2617.4">2.2</a>, <a href="#rfc.xref.RFC2617.5">3.1</a>, <a href="#rfc.xref.RFC2617.6">3.2</a>, <a href="#rfc.xref.RFC2617.7">3.3</a>, <a href="#rfc.xref.RFC2617.8">3.4</a>, <a href="#RFC2617"><b>7.1</b></a></li>
<li>401 Unauthorized&nbsp;&nbsp;<a href="#rfc.iref.s.1"><b>2.1</b></a></li>
<li>407 Proxy Authentication Required&nbsp;&nbsp;<a href="#rfc.iref.s.2"><b>2.2</b></a></li>
<li>WWW-Authenticate header&nbsp;&nbsp;<a href="#rfc.xref.header.www-authenticate.1">2.1</a>, <a href="#rfc.iref.w.1"><b>3.4</b></a></li>