Source: https://trac.ietf.org/trac/httpbis/export/2190/draft-ietf-httpbis/latest/p7-auth.html
Timestamp: 2020-04-05 10:22:01
Document Index: 730250152

Matched Legal Cases: ['art2', 'art1', 'art1', 'art6', 'art1', 'art1', 'art1', 'art2', 'art1', 'art1', 'art2', 'art6', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art2']

Intended status: Standards Track February 23, 2013
Expires: August 27, 2013
The Hypertext Transfer Protocol (HTTP) is an application-level protocol for distributed, collaborative, hypermedia information systems. This document defines the HTTP Authentication framework.
This Internet-Draft will expire on August 27, 2013.
6.2 Protection Spaces
D.1 Since draft-ietf-httpbis-p7-auth-19
D.2 Since draft-ietf-httpbis-p7-auth-20
D.3 Since draft-ietf-httpbis-p7-auth-21
D.4 Since draft-ietf-httpbis-p7-auth-22
This document defines HTTP/1.1 access control and authentication. It includes the relevant parts of RFC 2616 with only minor changes ( [RFC2616] ), plus the general framework for HTTP authentication, as previously defined in "HTTP Authentication: Basic and Digest Access Authentication" ( [RFC2617] ).
HTTP provides several OPTIONAL challenge-response authentication mechanisms that can be used by a server to challenge a client request and by a client to provide authentication information. The "basic" and "digest" authentication schemes continue to be specified in RFC 2617 .
Note: Many clients fail to parse challenges containing unknown schemes. A workaround for this problem is to list well-supported schemes (such as "basic") first.
Both the Authorization field value and the Proxy-Authorization field value contain the client's credentials for the realm of the resource being requested, based upon a challenge received from the server (possibly at some point in the past). When creating their values, the user agent ought to do so by selecting the challenge with what it considers to be the most secure auth-scheme that it understands, obtaining credentials from the user as appropriate.
Upon a request for a protected resource that omits credentials, contains invalid credentials (e.g., a bad password) or partial credentials (e.g., when the authentication scheme requires more than one round trip), an origin server SHOULD send a 401 (Unauthorized) response that contains a WWW-Authenticate header field with at least one (possibly new) challenge applicable to the requested resource.
Likewise, upon a request that requires authentication by proxies that omit credentials or contain invalid or partial credentials, a proxy SHOULD send a 407 (Proxy Authentication Required) response that contains a Proxy-Authenticate header field with a (possibly new) challenge applicable to the proxy.
A server receiving credentials that are valid, but not adequate to gain access, ought to respond with the 403 (Forbidden) status code (Section 6.5.3 of [Part2] ).
Proxies MUST forward the WWW-Authenticate and Authorization header fields unmodified and follow the rules found in Section 4.1.
A protection space is defined by the canonical root URI (the scheme and authority components of the effective request URI; see Section 5.5 of [Part1] ) of the server being accessed, in combination with the realm value if present. These realms allow the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme and/or authorization database. The realm value is a string, generally assigned by the origin server, that can have additional semantics specific to the authentication scheme. Note that there can be multiple challenges with the same auth-scheme but different realms.
HTTP authentication is presumed to be stateless: all of the information necessary to authenticate a request MUST be provided in the request, rather than be dependent on the server remembering prior requests. Authentication based on, or bound to, the underlying connection is outside the scope of this specification and inherently flawed unless steps are taken to ensure that the connection cannot be used by any party other than the authenticated user (see Section 2.3 of [Part1] ).
The "token68" notation was introduced for compatibility with existing authentication schemes and can only be used once per challenge/credentials. New schemes thus ought to use the "auth-param" syntax instead, because otherwise future extensions will be impossible.
Therefore, new authentication schemes that choose not to carry credentials in the Authorization header field (e.g., using a newly defined header field) will need to explicitly disallow caching, by mandating the use of either Cache-Control request directives (e.g., "no-store") or response directives (e.g., "private").
The 401 (Unauthorized) status code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource. The origin server MUST send a WWW-Authenticate header field (Section 4.4) containing at least one challenge applicable to the target resource. If the request included authentication credentials, then the 401 response indicates that authorization has been refused for those credentials. The client MAY repeat the request with a new or replaced Authorization header field (Section 4.1). If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user agent SHOULD present the enclosed representation to the user, since it usually contains relevant diagnostic information.
The 407 (Proxy Authentication Required) status code is similar to 401 (Unauthorized), but indicates that the client needs to authenticate itself in order to use a proxy. The proxy MUST send a Proxy-Authenticate header field (Section 4.2) containing a challenge applicable to that proxy for the target resource. The client MAY repeat the request with a new or replaced Proxy-Authorization header field (Section 4.3).
See Section 3.2 of [Part6] for details of and requirements pertaining to handling of the Authorization field by HTTP caches.
The "Proxy-Authenticate" header field consists of at least one challenge that indicates the authentication scheme(s) and parameters applicable to the proxy for this effective request URI (Section 5.5 of [Part1] ). It MUST be included as part of a 407 (Proxy Authentication Required) response.
Unlike WWW-Authenticate, the Proxy-Authenticate header field applies only to the current connection, and intermediaries SHOULD NOT forward it to downstream clients. However, an intermediate proxy might need to obtain its own credentials by requesting them from the downstream client, which in some circumstances will appear as if the proxy is forwarding the Proxy-Authenticate header field.
Note that the parsing considerations for WWW-Authenticate apply to this header field as well; see Section 4.4 for details.
The "Proxy-Authorization" header field allows the client to identify itself (or its user) to a proxy that requires authentication. Its value consists of credentials containing the authentication information of the user agent for the proxy and/or realm of the resource being requested.
The "WWW-Authenticate" header field consists of at least one challenge that indicates the authentication scheme(s) and parameters applicable to the effective request URI (Section 5.5 of [Part1] ).
Note: The challenge grammar production uses the list syntax as well. Therefore, a sequence of comma, whitespace, and comma can be considered both as applying to the preceding challenge, or to be an empty entry in the list of challenges. In practice, this ambiguity does not affect the semantics of the header field value and thus is harmless.
This section is meant to inform developers, information providers, and users of known security concerns specific to HTTP/1.1 authentication. More general security considerations are addressed in HTTP messaging [Part1] and semantics [Part2] .
This is currently under separate study. There are a number of work-arounds to parts of this problem, and we encourage the use of password protection in screen savers, idle time-outs, and other methods that mitigate the security problems inherent in this problem. In particular, user agents that cache credentials are encouraged to provide a readily accessible mechanism for discarding cached credentials under user control.
Authentication schemes that solely rely on the "realm" mechanism for establishing a protection space will expose credentials to all resources on a server. Clients that have successfully made authenticated requests with a resource can use the same authentication credentials for other resources on the same server. This makes it possible for a different resource to harvest authentication credentials for other resources.
This is of particular concern when a server hosts resources for multiple parties under the same canonical root URI (Section 2.2). Possible mitigation strategies include restricting direct access to authentication credentials (i.e., not making the content of the Authorization request header field available), and separating protection spaces by using a different host name for each party.
See Section 9 of [Part1] for the Acknowledgments related to this document revision.
[Part1] Fielding, R., Ed. and J. Reschke, Ed., “Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing”, Internet-Draft draft-ietf-httpbis-p1-messaging-latest (work in progress), February 2013.
[Part2] Fielding, R., Ed. and J. Reschke, Ed., “Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content”, Internet-Draft draft-ietf-httpbis-p2-semantics-latest (work in progress), February 2013.
[Part6] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, Ed., “Hypertext Transfer Protocol (HTTP/1.1): Caching”, Internet-Draft draft-ietf-httpbis-p6-cache-latest (work in progress), February 2013.
This specification introduces the Authentication Scheme Registry, along with considerations for new authentication schemes. (Section 2.3)
BWS           = <BWS, defined in [Part1] , Section 3.2.3>
quoted-string = <quoted-string, defined in [Part1] , Section 3.2.6>
token         = <token, defined in [Part1] , Section 3.2.6>
BWS = <BWS, defined in [Part1], Section 3.2.3>
quoted-string = <quoted-string, defined in [Part1], Section 3.2.6>
Changes up to the first Working Group Last Call draft are summarized in <http://trac.tools.ietf.org/html/draft-ietf-httpbis-p7-auth-19#appendix-C>.
<http://tools.ietf.org/wg/httpbis/trac/ticket/348>: "Realms and scope"
<http://tools.ietf.org/wg/httpbis/trac/ticket/349>: "Strength"
<http://tools.ietf.org/wg/httpbis/trac/ticket/357>: "Authentication exchanges"
<http://tools.ietf.org/wg/httpbis/trac/ticket/376>: "rename b64token for clarity"
<http://tools.ietf.org/wg/httpbis/trac/ticket/403>: "Authentication and caching - max-age"
4 A B C G P R W
Part1 1.1, 1.2, 2.2, 2.3.1, 4.2, 4.4, 6, 7, 8.1, B, B, B, B, B
Section 2.3 2.3.1
Section 5.5 2.2, 4.2, 4.4
Part2 2.1, 6, 8.1
RFC2616 1, 1, 8.2
WWW-Authenticate header field 3.1, 4.2, 4.4, 5.3