Source: https://trac.ietf.org/trac/httpbis/browser/draft-ietf-httpbis/diffs/draft-ietf-httpbis-p7-auth-23-from-22.diff.html?rev=2650&order=size
Timestamp: 2020-08-14 03:14:20
Document Index: 689945523

Matched Legal Cases: ['art1', 'art1', 'art2', 'art2', 'art1', 'art6', 'art6', 'art1', 'art6', 'art6', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1']

draft-ietf-httpbis-p7-auth-23-from-22.diff.html in draft-ietf-httpbis/diffs – Hypertext Transfer Protocol Wiki
source: draft-ietf-httpbis/diffs/draft-ietf-httpbis-p7-auth-23-from-22.diff.html @ 2650
Last change on this file since 2650 was 2304, checked in by julian.reschke@…, 7 years ago
<title>Diff: draft-ietf-httpbis-p7-auth-22.txt - draft-ietf-httpbis-p7-auth-23.txt</title>
<tr bgcolor="orange"><th></th><th>&nbsp;draft-ietf-httpbis-p7-auth-22.txt&nbsp;</th><th> </th><th>&nbsp;draft-ietf-httpbis-p7-auth-23.txt&nbsp;</th><th></th></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock">Intended status: Standards Track <span class="delete">February 23,</span> 2013</td><td> </td><td class="rblock">Intended status: Standards Track <span class="insert">July 15,</span> 2013</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock">Expires: <span class="delete">August 27, 2013</span></td><td> </td><td class="rblock">Expires: <span class="insert">January 16, 2014</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> draft-ietf-httpbis-p7-auth-2<span class="delete">2</span></td><td> </td><td class="rblock"> draft-ietf-httpbis-p7-auth-2<span class="insert">3</span></td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l2" /><small>skipping to change at</small><em> page 3, line 13</em></th><th> </th><th><a name="part-r2" /><small>skipping to change at</small><em> page 3, line 13</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> 2. Access Authentication Framework . . . . . . . . . . . . . . . 4</td><td> </td><td class="right"> 2. Access Authentication Framework . . . . . . . . . . . . . . . 4</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> 2.1. Challenge and Response . . . . . . . . . . . . . . . . . . 4</td><td> </td><td class="right"> 2.1. Challenge and Response . . . . . . . . . . . . . . . . . . 4</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> <span class="delete">2.3. Authentication Scheme Registry . . . . . . . . . . . . . . 7</span></td><td> </td><td class="rblock"> 3. Status Code Definitions . . . . . . . . . . . . . . . . . . . <span class="insert">7</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> 2.3.1. Considerations for New Authentication Schemes . . . . 7</span></td><td> </td><td class="rblock"> 3.1. 401 Unauthorized . . . . . . . . . . . . . . . . . . . . . <span class="insert">7</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 3. Status Code Definitions . . . . . . . . . . . . . . . . . . . <span class="delete">9</span></td><td> </td><td class="rblock"> 3.2. 407 Proxy Authentication Required . . . . . . . . . . . . <span class="insert">7</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 3.1. 401 Unauthorized . . . . . . . . . . . . . . . . . . . . . <span class="delete">9</span></td><td> </td><td class="rblock"> 4. Header Field Definitions . . . . . . . . . . . . . . . . . . . <span class="insert">7</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 3.2. 407 Proxy Authentication Required . . . . . . . . . . . . <span class="delete">9</span></td><td> </td><td class="rblock"> 4.1. Authorization . . . . . . . . . . . . . . . . . . . . . . <span class="insert">8</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 4. Header Field Definitions . . . . . . . . . . . . . . . . . . . <span class="delete">9</span></td><td> </td><td class="rblock"> 4.2. Proxy-Authenticate . . . . . . . . . . . . . . . . . . . . <span class="insert">8</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 4.1. Authorization . . . . . . . . . . . . . . . . . . . . . . <span class="delete">9</span></td><td> </td><td class="rblock"> 4.3. Proxy-Authorization . . . . . . . . . . . . . . . . . . . <span class="insert">8</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 4.2. Proxy-Authenticate . . . . . . . . . . . . . . . . . . . . <span class="delete">10</span></td><td> </td><td class="rblock"> 4.4. WWW-Authenticate . . . . . . . . . . . . . . . . . . . . . <span class="insert">9</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 4.3. Proxy-Authorization . . . . . . . . . . . . . . . . . . . <span class="delete">10</span></td><td> </td><td class="rblock"> 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . <span class="insert">10</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 4.4. WWW-Authenticate . . . . . . . . . . . . . . . . . . . . . <span class="delete">10</span></td><td> </td><td class="rblock"> 5.1. Authentication Scheme Registry . . . . . . . . . . . . . . <span class="insert">10</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . <span class="delete">11</span></td><td> </td><td class="rblock"><span class="insert"> 5.1.1. Procedure . . . . . . . . . . . . . . . . . . . . . . 10</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 5.1. Authentication Scheme Registry . . . . . . . . . . . . . . <span class="delete">11</span></td><td> </td><td class="rblock"><span class="insert"> 5.1.2. Considerations for New Authentication Schemes . . . . 10</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> 5.2. Status Code Registration . . . . . . . . . . . . . . . . . 11</td><td> </td><td class="right"> 5.2. Status Code Registration . . . . . . . . . . . . . . . . . 11</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> 6.1. Authentication Credentials and Idle Clients . . . . . . . 12</td><td> </td><td class="right"> 6.1. Authentication Credentials and Idle Clients . . . . . . . 12</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . <span class="delete">13</span></td><td> </td><td class="rblock"> 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . <span class="insert">14</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 8.1. Normative References . . . . . . . . . . . . . . . . . . . <span class="delete">13</span></td><td> </td><td class="rblock"> 8.1. Normative References . . . . . . . . . . . . . . . . . . . <span class="insert">14</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> Appendix A. Changes from RFCs 2616 and 2617 . . . . . . . . . . . 1<span class="delete">4</span></td><td> </td><td class="rblock"> Appendix A. Changes from RFCs 2616 and 2617 . . . . . . . . . . . 1<span class="insert">5</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> Appendix C. Collected ABNF . . . . . . . . . . . . . . . . . . . 1<span class="delete">6</span></td><td> </td><td class="rblock"> Appendix C. Collected ABNF . . . . . . . . . . . . . . . . . . . 1<span class="insert">5</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> D.3. Since draft-ietf-httpbis-p7-auth-21 . . . . . . . . . . . 17</td><td> </td><td class="right"> D.3. Since draft-ietf-httpbis-p7-auth-21 . . . . . . . . . . . 17</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> D.4. Since draft-ietf-httpbis-p7-auth-22 . . . . . . . . . . . 17</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> <span class="delete">mechanism</span>s that can be used by a server to challenge a client request</td><td> </td><td class="rblock"> <span class="insert">scheme</span>s that can be used by a server to challenge a client request</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> and by a client to provide authentication information. The "basic"</td><td> </td><td class="right"> and by a client to provide authentication information. The "basic"</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> and "digest" authentication schemes continue to be specified in RFC</td><td> </td><td class="right"> and "digest" authentication schemes continue to be specified in RFC</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> 2617.</td><td> </td><td class="right"> 2617.</td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l3" /><small>skipping to change at</small><em> page 4, line 40</em></th><th> </th><th><a name="part-r3" /><small>skipping to change at</small><em> page 4, line 40</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> 1.2 of [Part1]. Appendix B describes rules imported from other</td><td> </td><td class="right"> 1.2 of [Part1]. Appendix B describes rules imported from other</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> documents. Appendix C shows the collected ABNF with the list rule</td><td> </td><td class="right"> documents. Appendix C shows the collected ABNF with the list rule</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> HTTP provides a simple challenge-response authentication <span class="delete">mechanism</span></td><td> </td><td class="rblock"> HTTP provides a simple challenge-response authentication <span class="insert">framework</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> client to provide authentication information. It uses <span class="delete">an extensible,</span></td><td> </td><td class="rblock"> client to provide authentication information. It uses <span class="insert">a case-</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> case-insensitive</span> token to identify the authentication scheme,</td><td> </td><td class="rblock"><span class="insert"> insensitive</span> token <span class="insert">as a means</span> to identify the authentication scheme,</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> Parameters are name-value pairs where the name is matched case-</td><td> </td><td class="right"> Parameters are name-value pairs where the name is matched case-</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> insensitively, and each parameter name MUST only occur once per</td><td> </td><td class="right"> insensitively, and each parameter name MUST only occur once per</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> challenge.</td><td> </td><td class="right"> challenge.</td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l4" /><small>skipping to change at</small><em> page 6, line 4</em></th><th> </th><th><a name="part-r4" /><small>skipping to change at</small><em> page 6, line 4</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> -- can do so by including an Authorization header field with the</td><td> </td><td class="right"> -- can do so by including an Authorization header field with the</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> Required) -- can do so by including a Proxy-Authorization header</td><td> </td><td class="right"> Required) -- can do so by including a Proxy-Authorization header</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> value contain the client's credentials for the realm of the resource</td><td> </td><td class="right"> value contain the client's credentials for the realm of the resource</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> being requested, based upon a challenge received <span class="delete">from the server</span></td><td> </td><td class="rblock"> being requested, based upon a challenge received <span class="insert">in a response</span></td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l5" /><small>skipping to change at</small><em> page 6, line 30</em></th><th> </th><th><a name="part-r5" /><small>skipping to change at</small><em> page 6, line 30</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> SHOULD send a 407 (Proxy Authentication Required) response that</td><td> </td><td class="right"> SHOULD send a 407 (Proxy Authentication Required) response that</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> contains a Proxy-Authenticate header field with a (possibly new)</td><td> </td><td class="right"> contains a Proxy-Authenticate header field with a (possibly new)</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> challenge applicable to the proxy.</td><td> </td><td class="right"> challenge applicable to the proxy.</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> (Section 6.5.3 of [Part2]).</td><td> </td><td class="right"> (Section 6.5.3 of [Part2]).</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> challenge-response <span class="delete">mechanism</span> for access authentication. Additional</td><td> </td><td class="rblock"> challenge-response <span class="insert">framework</span> for access authentication. Additional</td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l6" /><small>skipping to change at</small><em> page 7, line 4</em></th><th> </th><th><a name="part-r6" /><small>skipping to change at</small><em> page 7, line 4</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> that can have additional semantics specific to the authentication</td><td> </td><td class="right"> that can have additional semantics specific to the authentication</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> scheme. Note that <span class="delete">there</span> can <span class="delete">be</span> multiple challenges with the same</td><td> </td><td class="rblock"> scheme. Note that <span class="insert">a response</span> can <span class="insert">have</span> multiple challenges with the</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> auth-scheme but different realms.</td><td> </td><td class="rblock"> same auth-scheme but different realms.</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> <span class="delete">otherwise defined</span> by the authentication scheme, a single protection</td><td> </td><td class="rblock"> <span class="insert">specifically allowed</span> by the authentication scheme, a single</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> space cannot extend outside the scope of its server.</td><td> </td><td class="rblock"> protection space cannot extend outside the scope of its server.</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> For historical reasons, senders MUST only <span class="delete">us</span>e the quoted-string</td><td> </td><td class="rblock"> For historical reasons, senders MUST only <span class="insert">generat</span>e the quoted-string</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> syntax. Recipients might have to support both token and quoted-</td><td> </td><td class="right"> syntax. Recipients might have to support both token and quoted-</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> string syntax for maximum interoperability with existing clients that</td><td> </td><td class="right"> string syntax for maximum interoperability with existing clients that</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> have been accepting both notations for a long time.</td><td> </td><td class="right"> have been accepting both notations for a long time.</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete">2.3. Authentication Scheme Registry</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> The HTTP Authentication Scheme Registry defines the name space for</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> the authentication schemes in challenges and credentials.</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> Registrations MUST include the following fields:</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> o Authentication Scheme Name</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> o Pointer to specification text</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> o Notes (optional)</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> Values to be added to this name space require IETF Review (see</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> [RFC5226], Section 4.1).</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> The registry itself is maintained at</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> &lt;http://www.iana.org/assignments/http-authschemes&gt;.</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete">2.3.1. Considerations for New Authentication Schemes</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> There are certain aspects of the HTTP Authentication Framework that</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> put constraints on how new authentication schemes can work:</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> o HTTP authentication is presumed to be stateless: all of the</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> information necessary to authenticate a request MUST be provided</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> in the request, rather than be dependent on the server remembering</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> prior requests. Authentication based on, or bound to, the</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> underlying connection is outside the scope of this specification</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> and inherently flawed unless steps are taken to ensure that the</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> connection cannot be used by any party other than the</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> authenticated user (see Section 2.3 of [Part1]).</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> o The authentication parameter "realm" is reserved for defining</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> Protection Spaces as defined in Section 2.2. New schemes MUST NOT</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> use it in a way incompatible with that definition.</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> o The "token68" notation was introduced for compatibility with</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> existing authentication schemes and can only be used once per</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> challenge/credentials. New schemes thus ought to use the "auth-</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> param" syntax instead, because otherwise future extensions will be</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> impossible.</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> o The parsing of challenges and credentials is defined by this</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> specification, and cannot be modified by new authentication</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> schemes. When the auth-param syntax is used, all parameters ought</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> to support both token and quoted-string syntax, and syntactical</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> constraints ought to be defined on the field value after parsing</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> (i.e., quoted-string processing). This is necessary so that</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> recipients can use a generic parser that applies to all</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> authentication schemes.</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> Note: The fact that the value syntax for the "realm" parameter is</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> restricted to quoted-string was a bad design choice not to be</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> repeated for new parameters.</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> o Definitions of new schemes ought to define the treatment of</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> unknown extension parameters. In general, a "must-ignore" rule is</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> preferable over "must-understand", because otherwise it will be</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> hard to introduce new parameters in the presence of legacy</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> recipients. Furthermore, it's good to describe the policy for</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> defining new parameters (such as "update the specification", or</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> "use this registry").</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> o Authentication schemes need to document whether they are usable in</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> origin-server authentication (i.e., using WWW-Authenticate),</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> and/or proxy authentication (i.e., using Proxy-Authenticate).</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> o The credentials carried in an Authorization header field are</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> specific to the User Agent, and therefore have the same effect on</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> HTTP caches as the "private" Cache-Control response directive,</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> within the scope of the request they appear in.</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> Therefore, new authentication schemes that choose not to carry</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> credentials in the Authorization header field (e.g., using a newly</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> defined header field) will need to explicitly disallow caching, by</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> mandating the use of either Cache-Control request directives</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> (e.g., "no-store") or response directives (e.g., "private").</span></td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> The 401 (Unauthorized) status code indicates that the request has not</td><td> </td><td class="right"> The 401 (Unauthorized) status code indicates that the request has not</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> been applied because it lacks valid authentication credentials for</td><td> </td><td class="right"> been applied because it lacks valid authentication credentials for</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> the target resource. The origin server MUST send a WWW-Authenticate</td><td> </td><td class="right"> the target resource. The origin server MUST send a WWW-Authenticate</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> header field (Section 4.4) containing at least one challenge</td><td> </td><td class="right"> header field (Section 4.4) containing at least one challenge</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> applicable to the target resource. If the request included</td><td> </td><td class="right"> applicable to the target resource. If the request included</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> authentication credentials, then the 401 response indicates that</td><td> </td><td class="right"> authentication credentials, then the 401 response indicates that</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> authorization has been refused for those credentials. The <span class="delete">client</span> MAY</td><td> </td><td class="rblock"> authorization has been refused for those credentials. The <span class="insert">user agent</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> repeat the request with a new or replaced Authorization header field</td><td> </td><td class="rblock"> MAY repeat the request with a new or replaced Authorization header</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> (Section 4.1). If the 401 response contains the same challenge as</td><td> </td><td class="rblock"> field (Section 4.1). If the 401 response contains the same challenge</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> the prior response, and the user agent has already attempted</td><td> </td><td class="rblock"> as the prior response, and the user agent has already attempted</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> authentication at least once, then the user agent SHOULD present the</td><td> </td><td class="right"> authentication at least once, then the user agent SHOULD present the</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> enclosed representation to the user, since it usually contains</td><td> </td><td class="right"> enclosed representation to the user, since it usually contains</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> relevant diagnostic information.</td><td> </td><td class="right"> relevant diagnostic information.</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> (Unauthorized), but indicates that the client needs to authenticate</td><td> </td><td class="right"> (Unauthorized), but indicates that the client needs to authenticate</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> itself in order to use a proxy. The proxy MUST send a Proxy-</td><td> </td><td class="right"> itself in order to use a proxy. The proxy MUST send a Proxy-</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> Authenticate header field (Section 4.2) containing a challenge</td><td> </td><td class="right"> Authenticate header field (Section 4.2) containing a challenge</td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l7" /><small>skipping to change at</small><em> page 9, line 41</em></th><th> </th><th><a name="part-r7" /><small>skipping to change at</small><em> page 8, line 8</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> field (Section 4.3).</td><td> </td><td class="right"> field (Section 4.3).</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> itself with <span class="delete">a</span> server -- usually, but not necessarily, after receiving</td><td> </td><td class="rblock"> itself with <span class="insert">an origin</span> server -- usually, but not necessarily, after</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> a 401 (Unauthorized) response. Its value consists of credentials</td><td> </td><td class="rblock"> receiving a 401 (Unauthorized) response. Its value consists of</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> containing information of the user agent for the realm of the</td><td> </td><td class="rblock"> credentials containing information of the user agent for the realm of</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> resource being requested.</td><td> </td><td class="rblock"> the resource being requested.</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> See Section 3.2 of [Part6] for details of and requirements pertaining</td><td> </td><td class="right"> See Section 3.2 of [Part6] for details of and requirements pertaining</td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l8" /><small>skipping to change at</small><em> page 10, line 33</em></th><th> </th><th><a name="part-r8" /><small>skipping to change at</small><em> page 8, line 49</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> itself (or its user) to a proxy that requires authentication. Its</td><td> </td><td class="right"> itself (or its user) to a proxy that requires authentication. Its</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> information of the <span class="delete">user agent</span> for the proxy and/or realm of the</td><td> </td><td class="rblock"> information of the <span class="insert">client</span> for the proxy and/or realm of the resource</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> resource being requested.</td><td> </td><td class="rblock"> being requested.</td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l9" /><small>skipping to change at</small><em> page 11, line 38</em></th><th> </th><th><a name="part-r9" /><small>skipping to change at</small><em> page 10, line 9</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> The <span class="delete">registration procedure for HTTP Authentication Schemes is defined</span></td><td> </td><td class="rblock"> The HTTP Authentication Scheme <span class="insert">Registry defines the name space for</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> by Section 2.3 of this document.</span></td><td> </td><td class="rblock"><span class="insert"> the authentication schemes in challenges and credentials. It will</span> be</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"></span></td><td> </td><td class="rblock"> created <span class="insert">and maintained</span> at</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"><span class="delete"> The</span> HTTP <span class="delete">Method</span> Authentication Scheme <span class="delete">shall</span> be created at</td><td> </td><td class="rblock"></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert">5.1.1. Procedure</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> o Notes (optional)</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> Values to be added to this name space require IETF Review (see</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> [RFC5226], Section 4.1).</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert">5.1.2. Considerations for New Authentication Schemes</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> o HTTP authentication is presumed to be stateless: all of the</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> information necessary to authenticate a request MUST be provided</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> in the request, rather than be dependent on the server remembering</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> prior requests. Authentication based on, or bound to, the</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> underlying connection is outside the scope of this specification</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> and inherently flawed unless steps are taken to ensure that the</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> connection cannot be used by any party other than the</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> authenticated user (see Section 2.3 of [Part1]).</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> o The "token68" notation was introduced for compatibility with</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> challenge or credential. New schemes thus ought to use the "auth-</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> o The parsing of challenges and credentials is defined by this</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> o Definitions of new schemes ought to define the treatment of</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> HTTP caches as the "private" Cache-Control response directive</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> (Section 7.2.2.6 of [Part6]), within the scope of the request they</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> appear in.</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> Therefore, new authentication schemes that choose not to carry</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> credentials in the Authorization header field (e.g., using a newly</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> defined header field) will need to explicitly disallow caching, by</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> (e.g., "no-store", Section 7.2.1.5 of [Part6]) or response</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> directives (e.g., "private").</span></td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l10" /><small>skipping to change at</small><em> page 13, line 18</em></th><th> </th><th><a name="part-r10" /><small>skipping to change at</small><em> page 13, line 22</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> methods that mitigate the security problems inherent in this problem.</td><td> </td><td class="right"> methods that mitigate the security problems inherent in this problem.</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> In particular, user agents that cache credentials are encouraged to</td><td> </td><td class="right"> In particular, user agents that cache credentials are encouraged to</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> provide a readily accessible mechanism for discarding cached</td><td> </td><td class="right"> provide a readily accessible mechanism for discarding cached</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> credentials under user control.</td><td> </td><td class="right"> credentials under user control.</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> resources on a server. Clients that have successfully made</td><td> </td><td class="rblock"> resources on a<span class="insert">n origin</span> server. Clients that have successfully made</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> authentication credentials for other resources on the same server.</td><td> </td><td class="rblock"> authentication credentials for other resources on the same <span class="insert">origin</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> This makes it possible for a different resource to harvest</td><td> </td><td class="rblock"> server. This makes it possible for a different resource to harvest</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> This is of particular concern when <span class="delete">a</span> server hosts resources for</td><td> </td><td class="rblock"> This is of particular concern when <span class="insert">an origin</span> server hosts resources</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> multiple parties under the same canonical root URI (Section 2.2).</td><td> </td><td class="rblock"> for multiple parties under the same canonical root URI (Section 2.2).</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> Possible mitigation strategies include restricting direct access to</td><td> </td><td class="right"> Possible mitigation strategies include restricting direct access to</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> authentication credentials (i.e., not making the content of the</td><td> </td><td class="right"> authentication credentials (i.e., not making the content of the</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> Authorization request header field available), and separating</td><td> </td><td class="right"> Authorization request header field available), and separating</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> protection spaces by using a different host name for each party.</td><td> </td><td class="rblock"> protection spaces by using a different host name <span class="insert">(or port number)</span> for</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"> each party.</td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l11" /><small>skipping to change at</small><em> page 13, line 44</em></th><th> </th><th><a name="part-r11" /><small>skipping to change at</small><em> page 14, line 4</em></th><td></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l12" /><small>skipping to change at</small><em> page 15, line 13</em></th><th> </th><th><a name="part-r12" /><small>skipping to change at</small><em> page 15, line 20</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> The "realm" parameter is no longer always required on challenges;</td><td> </td><td class="right"> The "realm" parameter is no longer always required on challenges;</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> This specification introduces the Authentication Scheme Registry,</td><td> </td><td class="right"> This specification introduces the Authentication Scheme Registry,</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> along with considerations for new authentication schemes.</td><td> </td><td class="right"> along with considerations for new authentication schemes.</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> (Section <span class="delete">2.3</span>)</td><td> </td><td class="rblock"> (Section <span class="insert">5.1</span>)</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> BWS = &lt;BWS, defined in [Part1], Section 3.2.3&gt;</td><td> </td><td class="right"> BWS = &lt;BWS, defined in [Part1], Section 3.2.3&gt;</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> quoted-string = &lt;quoted-string, defined in [Part1], Section 3.2.6&gt;</td><td> </td><td class="right"> quoted-string = &lt;quoted-string, defined in [Part1], Section 3.2.6&gt;</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> token = &lt;token, defined in [Part1], Section 3.2.6&gt;</td><td> </td><td class="right"> token = &lt;token, defined in [Part1], Section 3.2.6&gt;</td><td class="lineno" valign="top"></td></tr>
<tr bgcolor="gray" ><td></td><th><a name="part-l13" /><small>skipping to change at</small><em> page 17, line 30</em></th><th> </th><th><a name="part-r13" /><small>skipping to change at</small><em> page 17, line 27</em></th><td></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left">D.3. Since draft-ietf-httpbis-p7-auth-21</td><td> </td><td class="right">D.3. Since draft-ietf-httpbis-p7-auth-21</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> o &lt;http://tools.ietf.org/wg/httpbis/trac/ticket/403&gt;:</td><td> </td><td class="right"> o &lt;http://tools.ietf.org/wg/httpbis/trac/ticket/403&gt;:</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="left"> "Authentication and caching - max-age"</td><td> </td><td class="right"> "Authentication and caching - max-age"</td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert">D.4. Since draft-ietf-httpbis-p7-auth-22</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> o &lt;http://tools.ietf.org/wg/httpbis/trac/ticket/439&gt;: "terminology:</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> mechanism vs framework vs scheme"</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> o &lt;http://tools.ietf.org/wg/httpbis/trac/ticket/463&gt;: "Editorial</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> o &lt;http://tools.ietf.org/wg/httpbis/trac/ticket/464&gt;: "placement of</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"></td><td> </td><td class="rblock"><span class="insert"> extension point considerations"</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 401 Unauthorized (status code) <span class="delete">9</span></td><td> </td><td class="rblock"> 401 Unauthorized (status code) <span class="insert">7</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> 407 Proxy Authentication Required (status code) <span class="delete">9</span></td><td> </td><td class="rblock"> 407 Proxy Authentication Required (status code) <span class="insert">7</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> Proxy-Authenticate <span class="delete">10</span></td><td> </td><td class="rblock"> Proxy-Authenticate <span class="insert">8</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> WWW-Authenticate <span class="delete">11</span></td><td> </td><td class="rblock"> WWW-Authenticate <span class="insert">9</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> Proxy-Authenticate header field <span class="delete">10</span></td><td> </td><td class="rblock"> Proxy-Authenticate header field <span class="insert">8</span></td><td class="lineno" valign="top"></td></tr>
<tr><td class="lineno" valign="top"></td><td class="lblock"> WWW-Authenticate header field <span class="delete">10</span></td><td> </td><td class="rblock"> WWW-Authenticate header field <span class="insert">9</span></td><td class="lineno" valign="top"></td></tr>
<tr class="stats"><td></td><th><i>152 lines changed or deleted</i></th><th><i> </i></th><th><i>171 lines changed or added</i></th><td></td></tr>