| 1 | <!DOCTYPE html |
|---|
| 2 | PUBLIC "-//W3C//DTD HTML 4.01//EN"> |
|---|
| 3 | <html lang="en"> |
|---|
| 4 | <head profile="http://www.w3.org/2006/03/hcard http://dublincore.org/documents/2008/08/04/dc-html/"> |
|---|
| 5 | <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> |
|---|
| 6 | <title>HTTP/1.1, part 7: Authentication</title><style type="text/css" title="Xml2Rfc (sans serif)"> |
|---|
| 7 | a { |
|---|
| 8 | text-decoration: none; |
|---|
| 9 | } |
|---|
| 10 | a.smpl { |
|---|
| 11 | color: black; |
|---|
| 12 | } |
|---|
| 13 | a:hover { |
|---|
| 14 | text-decoration: underline; |
|---|
| 15 | } |
|---|
| 16 | a:active { |
|---|
| 17 | text-decoration: underline; |
|---|
| 18 | } |
|---|
| 19 | address { |
|---|
| 20 | margin-top: 1em; |
|---|
| 21 | margin-left: 2em; |
|---|
| 22 | font-style: normal; |
|---|
| 23 | } |
|---|
| 24 | body { |
|---|
| 25 | color: black; |
|---|
| 26 | font-family: verdana, helvetica, arial, sans-serif; |
|---|
| 27 | font-size: 10pt; |
|---|
| 28 | } |
|---|
| 29 | cite { |
|---|
| 30 | font-style: normal; |
|---|
| 31 | } |
|---|
| 32 | div.note { |
|---|
| 33 | margin-left: 2em; |
|---|
| 34 | } |
|---|
| 35 | dd { |
|---|
| 36 | margin-right: 2em; |
|---|
| 37 | } |
|---|
| 38 | dl { |
|---|
| 39 | margin-left: 2em; |
|---|
| 40 | } |
|---|
| 41 | |
|---|
| 42 | ul.empty { |
|---|
| 43 | list-style-type: none; |
|---|
| 44 | } |
|---|
| 45 | ul.empty li { |
|---|
| 46 | margin-top: .5em; |
|---|
| 47 | } |
|---|
| 48 | dl p { |
|---|
| 49 | margin-left: 0em; |
|---|
| 50 | } |
|---|
| 51 | dt { |
|---|
| 52 | margin-top: .5em; |
|---|
| 53 | } |
|---|
| 54 | h1 { |
|---|
| 55 | font-size: 14pt; |
|---|
| 56 | line-height: 21pt; |
|---|
| 57 | page-break-after: avoid; |
|---|
| 58 | } |
|---|
| 59 | h1.np { |
|---|
| 60 | page-break-before: always; |
|---|
| 61 | } |
|---|
| 62 | h1 a { |
|---|
| 63 | color: #333333; |
|---|
| 64 | } |
|---|
| 65 | h2 { |
|---|
| 66 | font-size: 12pt; |
|---|
| 67 | line-height: 15pt; |
|---|
| 68 | page-break-after: avoid; |
|---|
| 69 | } |
|---|
| 70 | h3, h4, h5, h6 { |
|---|
| 71 | font-size: 10pt; |
|---|
| 72 | page-break-after: avoid; |
|---|
| 73 | } |
|---|
| 74 | h2 a, h3 a, h4 a, h5 a, h6 a { |
|---|
| 75 | color: black; |
|---|
| 76 | } |
|---|
| 77 | img { |
|---|
| 78 | margin-left: 3em; |
|---|
| 79 | } |
|---|
| 80 | li { |
|---|
| 81 | margin-left: 2em; |
|---|
| 82 | margin-right: 2em; |
|---|
| 83 | } |
|---|
| 84 | ol { |
|---|
| 85 | margin-left: 2em; |
|---|
| 86 | margin-right: 2em; |
|---|
| 87 | } |
|---|
| 88 | ol.la { |
|---|
| 89 | list-style-type: lower-alpha; |
|---|
| 90 | } |
|---|
| 91 | ol.ua { |
|---|
| 92 | list-style-type: upper-alpha; |
|---|
| 93 | } |
|---|
| 94 | ol p { |
|---|
| 95 | margin-left: 0em; |
|---|
| 96 | } |
|---|
| 97 | p { |
|---|
| 98 | margin-left: 2em; |
|---|
| 99 | margin-right: 2em; |
|---|
| 100 | } |
|---|
| 101 | pre { |
|---|
| 102 | margin-left: 3em; |
|---|
| 103 | background-color: lightyellow; |
|---|
| 104 | padding: .25em; |
|---|
| 105 | } |
|---|
| 106 | pre.text2 { |
|---|
| 107 | border-style: dotted; |
|---|
| 108 | border-width: 1px; |
|---|
| 109 | background-color: #f0f0f0; |
|---|
| 110 | width: 69em; |
|---|
| 111 | } |
|---|
| 112 | pre.inline { |
|---|
| 113 | background-color: white; |
|---|
| 114 | padding: 0em; |
|---|
| 115 | } |
|---|
| 116 | pre.text { |
|---|
| 117 | border-style: dotted; |
|---|
| 118 | border-width: 1px; |
|---|
| 119 | background-color: #f8f8f8; |
|---|
| 120 | width: 69em; |
|---|
| 121 | } |
|---|
| 122 | pre.drawing { |
|---|
| 123 | border-style: solid; |
|---|
| 124 | border-width: 1px; |
|---|
| 125 | background-color: #f8f8f8; |
|---|
| 126 | padding: 2em; |
|---|
| 127 | } |
|---|
| 128 | table { |
|---|
| 129 | margin-left: 2em; |
|---|
| 130 | } |
|---|
| 131 | table.tt { |
|---|
| 132 | vertical-align: top; |
|---|
| 133 | } |
|---|
| 134 | table.full { |
|---|
| 135 | border-style: outset; |
|---|
| 136 | border-width: 1px; |
|---|
| 137 | } |
|---|
| 138 | table.headers { |
|---|
| 139 | border-style: outset; |
|---|
| 140 | border-width: 1px; |
|---|
| 141 | } |
|---|
| 142 | table.tt td { |
|---|
| 143 | vertical-align: top; |
|---|
| 144 | } |
|---|
| 145 | table.full td { |
|---|
| 146 | border-style: inset; |
|---|
| 147 | border-width: 1px; |
|---|
| 148 | } |
|---|
| 149 | table.tt th { |
|---|
| 150 | vertical-align: top; |
|---|
| 151 | } |
|---|
| 152 | table.full th { |
|---|
| 153 | border-style: inset; |
|---|
| 154 | border-width: 1px; |
|---|
| 155 | } |
|---|
| 156 | table.headers th { |
|---|
| 157 | border-style: none none inset none; |
|---|
| 158 | border-width: 1px; |
|---|
| 159 | } |
|---|
| 160 | table.left { |
|---|
| 161 | margin-right: auto; |
|---|
| 162 | } |
|---|
| 163 | table.right { |
|---|
| 164 | margin-left: auto; |
|---|
| 165 | } |
|---|
| 166 | table.center { |
|---|
| 167 | margin-left: auto; |
|---|
| 168 | margin-right: auto; |
|---|
| 169 | } |
|---|
| 170 | caption { |
|---|
| 171 | caption-side: bottom; |
|---|
| 172 | font-weight: bold; |
|---|
| 173 | font-size: 9pt; |
|---|
| 174 | margin-top: .5em; |
|---|
| 175 | } |
|---|
| 176 | |
|---|
| 177 | table.header { |
|---|
| 178 | border-spacing: 1px; |
|---|
| 179 | width: 95%; |
|---|
| 180 | font-size: 10pt; |
|---|
| 181 | color: white; |
|---|
| 182 | } |
|---|
| 183 | td.top { |
|---|
| 184 | vertical-align: top; |
|---|
| 185 | } |
|---|
| 186 | td.topnowrap { |
|---|
| 187 | vertical-align: top; |
|---|
| 188 | white-space: nowrap; |
|---|
| 189 | } |
|---|
| 190 | table.header td { |
|---|
| 191 | background-color: gray; |
|---|
| 192 | width: 50%; |
|---|
| 193 | } |
|---|
| 194 | table.header a { |
|---|
| 195 | color: white; |
|---|
| 196 | } |
|---|
| 197 | td.reference { |
|---|
| 198 | vertical-align: top; |
|---|
| 199 | white-space: nowrap; |
|---|
| 200 | padding-right: 1em; |
|---|
| 201 | } |
|---|
| 202 | thead { |
|---|
| 203 | display:table-header-group; |
|---|
| 204 | } |
|---|
| 205 | ul.toc, ul.toc ul { |
|---|
| 206 | list-style: none; |
|---|
| 207 | margin-left: 1.5em; |
|---|
| 208 | margin-right: 0em; |
|---|
| 209 | padding-left: 0em; |
|---|
| 210 | } |
|---|
| 211 | ul.toc li { |
|---|
| 212 | line-height: 150%; |
|---|
| 213 | font-weight: bold; |
|---|
| 214 | font-size: 10pt; |
|---|
| 215 | margin-left: 0em; |
|---|
| 216 | margin-right: 0em; |
|---|
| 217 | } |
|---|
| 218 | ul.toc li li { |
|---|
| 219 | line-height: normal; |
|---|
| 220 | font-weight: normal; |
|---|
| 221 | font-size: 9pt; |
|---|
| 222 | margin-left: 0em; |
|---|
| 223 | margin-right: 0em; |
|---|
| 224 | } |
|---|
| 225 | li.excluded { |
|---|
| 226 | font-size: 0pt; |
|---|
| 227 | } |
|---|
| 228 | ul p { |
|---|
| 229 | margin-left: 0em; |
|---|
| 230 | } |
|---|
| 231 | ul.ind, ul.ind ul { |
|---|
| 232 | list-style: none; |
|---|
| 233 | margin-left: 1.5em; |
|---|
| 234 | margin-right: 0em; |
|---|
| 235 | padding-left: 0em; |
|---|
| 236 | page-break-before: avoid; |
|---|
| 237 | } |
|---|
| 238 | ul.ind li { |
|---|
| 239 | font-weight: bold; |
|---|
| 240 | line-height: 200%; |
|---|
| 241 | margin-left: 0em; |
|---|
| 242 | margin-right: 0em; |
|---|
| 243 | } |
|---|
| 244 | ul.ind li li { |
|---|
| 245 | font-weight: normal; |
|---|
| 246 | line-height: 150%; |
|---|
| 247 | margin-left: 0em; |
|---|
| 248 | margin-right: 0em; |
|---|
| 249 | } |
|---|
| 250 | .avoidbreak { |
|---|
| 251 | page-break-inside: avoid; |
|---|
| 252 | } |
|---|
| 253 | .bcp14 { |
|---|
| 254 | font-style: normal; |
|---|
| 255 | text-transform: lowercase; |
|---|
| 256 | font-variant: small-caps; |
|---|
| 257 | } |
|---|
| 258 | .comment { |
|---|
| 259 | background-color: yellow; |
|---|
| 260 | } |
|---|
| 261 | .center { |
|---|
| 262 | text-align: center; |
|---|
| 263 | } |
|---|
| 264 | .error { |
|---|
| 265 | color: red; |
|---|
| 266 | font-style: italic; |
|---|
| 267 | font-weight: bold; |
|---|
| 268 | } |
|---|
| 269 | .figure { |
|---|
| 270 | font-weight: bold; |
|---|
| 271 | text-align: center; |
|---|
| 272 | font-size: 9pt; |
|---|
| 273 | } |
|---|
| 274 | .filename { |
|---|
| 275 | color: #333333; |
|---|
| 276 | font-weight: bold; |
|---|
| 277 | font-size: 12pt; |
|---|
| 278 | line-height: 21pt; |
|---|
| 279 | text-align: center; |
|---|
| 280 | } |
|---|
| 281 | .fn { |
|---|
| 282 | font-weight: bold; |
|---|
| 283 | } |
|---|
| 284 | .hidden { |
|---|
| 285 | display: none; |
|---|
| 286 | } |
|---|
| 287 | .left { |
|---|
| 288 | text-align: left; |
|---|
| 289 | } |
|---|
| 290 | .right { |
|---|
| 291 | text-align: right; |
|---|
| 292 | } |
|---|
| 293 | .title { |
|---|
| 294 | color: #990000; |
|---|
| 295 | font-size: 18pt; |
|---|
| 296 | line-height: 18pt; |
|---|
| 297 | font-weight: bold; |
|---|
| 298 | text-align: center; |
|---|
| 299 | margin-top: 36pt; |
|---|
| 300 | } |
|---|
| 301 | .vcardline { |
|---|
| 302 | display: block; |
|---|
| 303 | } |
|---|
| 304 | .warning { |
|---|
| 305 | font-size: 14pt; |
|---|
| 306 | background-color: yellow; |
|---|
| 307 | } |
|---|
| 308 | |
|---|
| 309 | |
|---|
| 310 | @media print { |
|---|
| 311 | .noprint { |
|---|
| 312 | display: none; |
|---|
| 313 | } |
|---|
| 314 | |
|---|
| 315 | a { |
|---|
| 316 | color: black; |
|---|
| 317 | text-decoration: none; |
|---|
| 318 | } |
|---|
| 319 | |
|---|
| 320 | table.header { |
|---|
| 321 | width: 90%; |
|---|
| 322 | } |
|---|
| 323 | |
|---|
| 324 | td.header { |
|---|
| 325 | width: 50%; |
|---|
| 326 | color: black; |
|---|
| 327 | background-color: white; |
|---|
| 328 | vertical-align: top; |
|---|
| 329 | font-size: 12pt; |
|---|
| 330 | } |
|---|
| 331 | |
|---|
| 332 | ul.toc a::after { |
|---|
| 333 | content: leader('.') target-counter(attr(href), page); |
|---|
| 334 | } |
|---|
| 335 | |
|---|
| 336 | ul.ind li li a { |
|---|
| 337 | content: target-counter(attr(href), page); |
|---|
| 338 | } |
|---|
| 339 | |
|---|
| 340 | .print2col { |
|---|
| 341 | column-count: 2; |
|---|
| 342 | column-fill: auto; |
|---|
| 343 | } |
|---|
| 344 | } |
|---|
| 345 | |
|---|
| 346 | @page { |
|---|
| 347 | @top-left { |
|---|
| 348 | content: "Internet-Draft"; |
|---|
| 349 | } |
|---|
| 350 | @top-right { |
|---|
| 351 | content: "January 2012"; |
|---|
| 352 | } |
|---|
| 353 | @top-center { |
|---|
| 354 | content: "HTTP/1.1, Part 7"; |
|---|
| 355 | } |
|---|
| 356 | @bottom-left { |
|---|
| 357 | content: "Fielding, et al."; |
|---|
| 358 | } |
|---|
| 359 | @bottom-center { |
|---|
| 360 | content: "Expires July 7, 2012"; |
|---|
| 361 | } |
|---|
| 362 | @bottom-right { |
|---|
| 363 | content: "[Page " counter(page) "]"; |
|---|
| 364 | } |
|---|
| 365 | } |
|---|
| 366 | |
|---|
| 367 | @page:first { |
|---|
| 368 | @top-left { |
|---|
| 369 | content: normal; |
|---|
| 370 | } |
|---|
| 371 | @top-right { |
|---|
| 372 | content: normal; |
|---|
| 373 | } |
|---|
| 374 | @top-center { |
|---|
| 375 | content: normal; |
|---|
| 376 | } |
|---|
| 377 | } |
|---|
| 378 | </style><link rel="Contents" href="#rfc.toc"> |
|---|
| 379 | <link rel="Author" href="#rfc.authors"> |
|---|
| 380 | <link rel="Copyright" href="#rfc.copyrightnotice"> |
|---|
| 381 | <link rel="Index" href="#rfc.index"> |
|---|
| 382 | <link rel="Chapter" title="1 Introduction" href="#rfc.section.1"> |
|---|
| 383 | <link rel="Chapter" title="2 Access Authentication Framework" href="#rfc.section.2"> |
|---|
| 384 | <link rel="Chapter" title="3 Status Code Definitions" href="#rfc.section.3"> |
|---|
| 385 | <link rel="Chapter" title="4 Header Field Definitions" href="#rfc.section.4"> |
|---|
| 386 | <link rel="Chapter" title="5 IANA Considerations" href="#rfc.section.5"> |
|---|
| 387 | <link rel="Chapter" title="6 Security Considerations" href="#rfc.section.6"> |
|---|
| 388 | <link rel="Chapter" title="7 Acknowledgments" href="#rfc.section.7"> |
|---|
| 389 | <link rel="Chapter" href="#rfc.section.8" title="8 References"> |
|---|
| 390 | <link rel="Appendix" title="A Changes from RFCs 2616 and 2617" href="#rfc.section.A"> |
|---|
| 391 | <link rel="Appendix" title="B Collected ABNF" href="#rfc.section.B"> |
|---|
| 392 | <link rel="Appendix" title="C Change Log (to be removed by RFC Editor before publication)" href="#rfc.section.C"> |
|---|
| 393 | <link href="p6-cache.html" rel="prev"> |
|---|
| 394 | <meta name="generator" content="http://greenbytes.de/tech/webdav/rfc2629.xslt, Revision 1.561, 2011-12-24 13:06:50, XSLT vendor: SAXON 8.9 from Saxonica http://www.saxonica.com/"> |
|---|
| 395 | <link rel="schema.dct" href="http://purl.org/dc/terms/"> |
|---|
| 396 | <meta name="dct.creator" content="Fielding, R."> |
|---|
| 397 | <meta name="dct.creator" content="Gettys, J."> |
|---|
| 398 | <meta name="dct.creator" content="Mogul, J."> |
|---|
| 399 | <meta name="dct.creator" content="Frystyk, H."> |
|---|
| 400 | <meta name="dct.creator" content="Masinter, L."> |
|---|
| 401 | <meta name="dct.creator" content="Leach, P."> |
|---|
| 402 | <meta name="dct.creator" content="Berners-Lee, T."> |
|---|
| 403 | <meta name="dct.creator" content="Lafon, Y."> |
|---|
| 404 | <meta name="dct.creator" content="Reschke, J. F."> |
|---|
| 405 | <meta name="dct.identifier" content="urn:ietf:id:draft-ietf-httpbis-p7-auth-latest"> |
|---|
| 406 | <meta name="dct.issued" scheme="ISO8601" content="2012-01-04"> |
|---|
| 407 | <meta name="dct.replaces" content="urn:ietf:rfc:2616"> |
|---|
| 408 | <meta name="dct.abstract" content="The Hypertext Transfer Protocol (HTTP) is an application-level protocol for distributed, collaborative, hypermedia information systems. HTTP has been in use by the World Wide Web global information initiative since 1990. This document is Part 7 of the seven-part specification that defines the protocol referred to as "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 7 defines the HTTP Authentication framework."> |
|---|
| 409 | <meta name="description" content="The Hypertext Transfer Protocol (HTTP) is an application-level protocol for distributed, collaborative, hypermedia information systems. HTTP has been in use by the World Wide Web global information initiative since 1990. This document is Part 7 of the seven-part specification that defines the protocol referred to as "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 7 defines the HTTP Authentication framework."> |
|---|
| 410 | </head> |
|---|
| 411 | <body> |
|---|
| 412 | <table class="header"> |
|---|
| 413 | <tbody> |
|---|
| 414 | <tr> |
|---|
| 415 | <td class="left">HTTPbis Working Group</td> |
|---|
| 416 | <td class="right">R. Fielding, Editor</td> |
|---|
| 417 | </tr> |
|---|
| 418 | <tr> |
|---|
| 419 | <td class="left">Internet-Draft</td> |
|---|
| 420 | <td class="right">Adobe</td> |
|---|
| 421 | </tr> |
|---|
| 422 | <tr> |
|---|
| 423 | <td class="left">Obsoletes: <a href="http://tools.ietf.org/html/rfc2616">2616</a> (if approved) |
|---|
| 424 | </td> |
|---|
| 425 | <td class="right">J. Gettys</td> |
|---|
| 426 | </tr> |
|---|
| 427 | <tr> |
|---|
| 428 | <td class="left">Updates: <a href="http://tools.ietf.org/html/rfc2617">2617</a> (if approved) |
|---|
| 429 | </td> |
|---|
| 430 | <td class="right">Alcatel-Lucent</td> |
|---|
| 431 | </tr> |
|---|
| 432 | <tr> |
|---|
| 433 | <td class="left">Intended status: Standards Track</td> |
|---|
| 434 | <td class="right">J. Mogul</td> |
|---|
| 435 | </tr> |
|---|
| 436 | <tr> |
|---|
| 437 | <td class="left">Expires: July 7, 2012</td> |
|---|
| 438 | <td class="right">HP</td> |
|---|
| 439 | </tr> |
|---|
| 440 | <tr> |
|---|
| 441 | <td class="left"></td> |
|---|
| 442 | <td class="right">H. Frystyk</td> |
|---|
| 443 | </tr> |
|---|
| 444 | <tr> |
|---|
| 445 | <td class="left"></td> |
|---|
| 446 | <td class="right">Microsoft</td> |
|---|
| 447 | </tr> |
|---|
| 448 | <tr> |
|---|
| 449 | <td class="left"></td> |
|---|
| 450 | <td class="right">L. Masinter</td> |
|---|
| 451 | </tr> |
|---|
| 452 | <tr> |
|---|
| 453 | <td class="left"></td> |
|---|
| 454 | <td class="right">Adobe</td> |
|---|
| 455 | </tr> |
|---|
| 456 | <tr> |
|---|
| 457 | <td class="left"></td> |
|---|
| 458 | <td class="right">P. Leach</td> |
|---|
| 459 | </tr> |
|---|
| 460 | <tr> |
|---|
| 461 | <td class="left"></td> |
|---|
| 462 | <td class="right">Microsoft</td> |
|---|
| 463 | </tr> |
|---|
| 464 | <tr> |
|---|
| 465 | <td class="left"></td> |
|---|
| 466 | <td class="right">T. Berners-Lee</td> |
|---|
| 467 | </tr> |
|---|
| 468 | <tr> |
|---|
| 469 | <td class="left"></td> |
|---|
| 470 | <td class="right">W3C/MIT</td> |
|---|
| 471 | </tr> |
|---|
| 472 | <tr> |
|---|
| 473 | <td class="left"></td> |
|---|
| 474 | <td class="right">Y. Lafon, Editor</td> |
|---|
| 475 | </tr> |
|---|
| 476 | <tr> |
|---|
| 477 | <td class="left"></td> |
|---|
| 478 | <td class="right">W3C</td> |
|---|
| 479 | </tr> |
|---|
| 480 | <tr> |
|---|
| 481 | <td class="left"></td> |
|---|
| 482 | <td class="right">J. Reschke, Editor</td> |
|---|
| 483 | </tr> |
|---|
| 484 | <tr> |
|---|
| 485 | <td class="left"></td> |
|---|
| 486 | <td class="right">greenbytes</td> |
|---|
| 487 | </tr> |
|---|
| 488 | <tr> |
|---|
| 489 | <td class="left"></td> |
|---|
| 490 | <td class="right">January 4, 2012</td> |
|---|
| 491 | </tr> |
|---|
| 492 | </tbody> |
|---|
| 493 | </table> |
|---|
| 494 | <p class="title">HTTP/1.1, part 7: Authentication<br><span class="filename">draft-ietf-httpbis-p7-auth-latest</span></p> |
|---|
| 495 | <h1 id="rfc.abstract"><a href="#rfc.abstract">Abstract</a></h1> |
|---|
| 496 | <p>The Hypertext Transfer Protocol (HTTP) is an application-level protocol for distributed, collaborative, hypermedia information |
|---|
| 497 | systems. HTTP has been in use by the World Wide Web global information initiative since 1990. This document is Part 7 of the |
|---|
| 498 | seven-part specification that defines the protocol referred to as "HTTP/1.1" and, taken together, obsoletes RFC 2616. |
|---|
| 499 | </p> |
|---|
| 500 | <p>Part 7 defines the HTTP Authentication framework.</p> |
|---|
| 501 | <h1 id="rfc.note.1"><a href="#rfc.note.1">Editorial Note (To be removed by RFC Editor)</a></h1> |
|---|
| 502 | <p>Discussion of this draft should take place on the HTTPBIS working group mailing list (ietf-http-wg@w3.org), which is archived |
|---|
| 503 | at <<a href="http://lists.w3.org/Archives/Public/ietf-http-wg/">http://lists.w3.org/Archives/Public/ietf-http-wg/</a>>. |
|---|
| 504 | </p> |
|---|
| 505 | <p>The current issues list is at <<a href="http://tools.ietf.org/wg/httpbis/trac/report/3">http://tools.ietf.org/wg/httpbis/trac/report/3</a>> and related documents (including fancy diffs) can be found at <<a href="http://tools.ietf.org/wg/httpbis/">http://tools.ietf.org/wg/httpbis/</a>>. |
|---|
| 506 | </p> |
|---|
| 507 | <p>The changes in this draft are summarized in <a href="#changes.since.18" title="Since draft-ietf-httpbis-p7-auth-18">Appendix C.20</a>. |
|---|
| 508 | </p> |
|---|
| 509 | <h1><a id="rfc.status" href="#rfc.status">Status of This Memo</a></h1> |
|---|
| 510 | <p>This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.</p> |
|---|
| 511 | <p>Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute |
|---|
| 512 | working documents as Internet-Drafts. The list of current Internet-Drafts is at <a href="http://datatracker.ietf.org/drafts/current/">http://datatracker.ietf.org/drafts/current/</a>. |
|---|
| 513 | </p> |
|---|
| 514 | <p>Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other |
|---|
| 515 | documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work |
|---|
| 516 | in progress”. |
|---|
| 517 | </p> |
|---|
| 518 | <p>This Internet-Draft will expire on July 7, 2012.</p> |
|---|
| 519 | <h1><a id="rfc.copyrightnotice" href="#rfc.copyrightnotice">Copyright Notice</a></h1> |
|---|
| 520 | <p>Copyright © 2012 IETF Trust and the persons identified as the document authors. All rights reserved.</p> |
|---|
| 521 | <p>This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights |
|---|
| 522 | and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License |
|---|
| 523 | text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified |
|---|
| 524 | BSD License. |
|---|
| 525 | </p> |
|---|
| 526 | <p>This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November |
|---|
| 527 | 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to |
|---|
| 528 | allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) |
|---|
| 529 | controlling the copyright in such materials, this document may not be modified outside the IETF Standards Process, and derivative |
|---|
| 530 | works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate |
|---|
| 531 | it into languages other than English. |
|---|
| 532 | </p> |
|---|
| 533 | <hr class="noprint"> |
|---|
| 534 | <h1 class="np" id="rfc.toc"><a href="#rfc.toc">Table of Contents</a></h1> |
|---|
| 535 | <ul class="toc"> |
|---|
| 536 | <li>1. <a href="#introduction">Introduction</a><ul> |
|---|
| 537 | <li>1.1 <a href="#intro.conformance.and.error.handling">Conformance and Error Handling</a></li> |
|---|
| 538 | <li>1.2 <a href="#notation">Syntax Notation</a><ul> |
|---|
| 539 | <li>1.2.1 <a href="#core.rules">Core Rules</a></li> |
|---|
| 540 | </ul> |
|---|
| 541 | </li> |
|---|
| 542 | </ul> |
|---|
| 543 | </li> |
|---|
| 544 | <li>2. <a href="#access.authentication.framework">Access Authentication Framework</a><ul> |
|---|
| 545 | <li>2.1 <a href="#challenge.and.response">Challenge and Response</a></li> |
|---|
| 546 | <li>2.2 <a href="#protection.space">Protection Space (Realm)</a></li> |
|---|
| 547 | <li>2.3 <a href="#authentication.scheme.registry">Authentication Scheme Registry</a><ul> |
|---|
| 548 | <li>2.3.1 <a href="#considerations.for.new.authentication.schemes">Considerations for New Authentication Schemes</a></li> |
|---|
| 549 | </ul> |
|---|
| 550 | </li> |
|---|
| 551 | </ul> |
|---|
| 552 | </li> |
|---|
| 553 | <li>3. <a href="#status.code.definitions">Status Code Definitions</a><ul> |
|---|
| 554 | <li>3.1 <a href="#status.401">401 Unauthorized</a></li> |
|---|
| 555 | <li>3.2 <a href="#status.407">407 Proxy Authentication Required</a></li> |
|---|
| 556 | </ul> |
|---|
| 557 | </li> |
|---|
| 558 | <li>4. <a href="#header.field.definitions">Header Field Definitions</a><ul> |
|---|
| 559 | <li>4.1 <a href="#header.authorization">Authorization</a></li> |
|---|
| 560 | <li>4.2 <a href="#header.proxy-authenticate">Proxy-Authenticate</a></li> |
|---|
| 561 | <li>4.3 <a href="#header.proxy-authorization">Proxy-Authorization</a></li> |
|---|
| 562 | <li>4.4 <a href="#header.www-authenticate">WWW-Authenticate</a></li> |
|---|
| 563 | </ul> |
|---|
| 564 | </li> |
|---|
| 565 | <li>5. <a href="#IANA.considerations">IANA Considerations</a><ul> |
|---|
| 566 | <li>5.1 <a href="#authentication.scheme.registration">Authenticaton Scheme Registry</a></li> |
|---|
| 567 | <li>5.2 <a href="#status.code.registration">Status Code Registration</a></li> |
|---|
| 568 | <li>5.3 <a href="#header.field.registration">Header Field Registration</a></li> |
|---|
| 569 | </ul> |
|---|
| 570 | </li> |
|---|
| 571 | <li>6. <a href="#security.considerations">Security Considerations</a><ul> |
|---|
| 572 | <li>6.1 <a href="#auth.credentials.and.idle.clients">Authentication Credentials and Idle Clients</a></li> |
|---|
| 573 | </ul> |
|---|
| 574 | </li> |
|---|
| 575 | <li>7. <a href="#acks">Acknowledgments</a></li> |
|---|
| 576 | <li>8. <a href="#rfc.references">References</a><ul> |
|---|
| 577 | <li>8.1 <a href="#rfc.references.1">Normative References</a></li> |
|---|
| 578 | <li>8.2 <a href="#rfc.references.2">Informative References</a></li> |
|---|
| 579 | </ul> |
|---|
| 580 | </li> |
|---|
| 581 | <li><a href="#rfc.authors">Authors' Addresses</a></li> |
|---|
| 582 | <li>A. <a href="#changes.from.rfc.2616">Changes from RFCs 2616 and 2617</a></li> |
|---|
| 583 | <li>B. <a href="#collected.abnf">Collected ABNF</a></li> |
|---|
| 584 | <li>C. <a href="#change.log">Change Log (to be removed by RFC Editor before publication)</a><ul> |
|---|
| 585 | <li>C.1 <a href="#rfc.section.C.1">Since RFC 2616</a></li> |
|---|
| 586 | <li>C.2 <a href="#rfc.section.C.2">Since draft-ietf-httpbis-p7-auth-00</a></li> |
|---|
| 587 | <li>C.3 <a href="#rfc.section.C.3">Since draft-ietf-httpbis-p7-auth-01</a></li> |
|---|
| 588 | <li>C.4 <a href="#changes.since.02">Since draft-ietf-httpbis-p7-auth-02</a></li> |
|---|
| 589 | <li>C.5 <a href="#changes.since.03">Since draft-ietf-httpbis-p7-auth-03</a></li> |
|---|
| 590 | <li>C.6 <a href="#changes.since.04">Since draft-ietf-httpbis-p7-auth-04</a></li> |
|---|
| 591 | <li>C.7 <a href="#changes.since.05">Since draft-ietf-httpbis-p7-auth-05</a></li> |
|---|
| 592 | <li>C.8 <a href="#changes.since.06">Since draft-ietf-httpbis-p7-auth-06</a></li> |
|---|
| 593 | <li>C.9 <a href="#changes.since.07">Since draft-ietf-httpbis-p7-auth-07</a></li> |
|---|
| 594 | <li>C.10 <a href="#changes.since.08">Since draft-ietf-httpbis-p7-auth-08</a></li> |
|---|
| 595 | <li>C.11 <a href="#changes.since.09">Since draft-ietf-httpbis-p7-auth-09</a></li> |
|---|
| 596 | <li>C.12 <a href="#changes.since.10">Since draft-ietf-httpbis-p7-auth-10</a></li> |
|---|
| 597 | <li>C.13 <a href="#changes.since.11">Since draft-ietf-httpbis-p7-auth-11</a></li> |
|---|
| 598 | <li>C.14 <a href="#changes.since.12">Since draft-ietf-httpbis-p7-auth-12</a></li> |
|---|
| 599 | <li>C.15 <a href="#changes.since.13">Since draft-ietf-httpbis-p7-auth-13</a></li> |
|---|
| 600 | <li>C.16 <a href="#changes.since.14">Since draft-ietf-httpbis-p7-auth-14</a></li> |
|---|
| 601 | <li>C.17 <a href="#changes.since.15">Since draft-ietf-httpbis-p7-auth-15</a></li> |
|---|
| 602 | <li>C.18 <a href="#changes.since.16">Since draft-ietf-httpbis-p7-auth-16</a></li> |
|---|
| 603 | <li>C.19 <a href="#changes.since.17">Since draft-ietf-httpbis-p7-auth-17</a></li> |
|---|
| 604 | <li>C.20 <a href="#changes.since.18">Since draft-ietf-httpbis-p7-auth-18</a></li> |
|---|
| 605 | </ul> |
|---|
| 606 | </li> |
|---|
| 607 | <li><a href="#rfc.index">Index</a></li> |
|---|
| 608 | </ul> |
|---|
| 609 | <h1 id="rfc.section.1" class="np"><a href="#rfc.section.1">1.</a> <a id="introduction" href="#introduction">Introduction</a></h1> |
|---|
| 610 | <p id="rfc.section.1.p.1">This document defines HTTP/1.1 access control and authentication. It includes the relevant parts of <cite title="Hypertext Transfer Protocol -- HTTP/1.1" id="rfc.xref.RFC2616.1">RFC 2616</cite> with only minor changes, plus the general framework for HTTP authentication, as previously defined in "HTTP Authentication: |
|---|
| 611 | Basic and Digest Access Authentication" (<a href="#RFC2617" id="rfc.xref.RFC2617.1"><cite title="HTTP Authentication: Basic and Digest Access Authentication">[RFC2617]</cite></a>). |
|---|
| 612 | </p> |
|---|
| 613 | <p id="rfc.section.1.p.2">HTTP provides several <em class="bcp14">OPTIONAL</em> challenge-response authentication mechanisms which can be used by a server to challenge a client request and by a client to |
|---|
| 614 | provide authentication information. The "basic" and "digest" authentication schemes continue to be specified in <cite title="HTTP Authentication: Basic and Digest Access Authentication" id="rfc.xref.RFC2617.2">RFC 2617</cite>. |
|---|
| 615 | </p> |
|---|
| 616 | <h2 id="rfc.section.1.1"><a href="#rfc.section.1.1">1.1</a> <a id="intro.conformance.and.error.handling" href="#intro.conformance.and.error.handling">Conformance and Error Handling</a></h2> |
|---|
| 617 | <p id="rfc.section.1.1.p.1">The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" |
|---|
| 618 | in this document are to be interpreted as described in <a href="#RFC2119" id="rfc.xref.RFC2119.1"><cite title="Key words for use in RFCs to Indicate Requirement Levels">[RFC2119]</cite></a>. |
|---|
| 619 | </p> |
|---|
| 620 | <p id="rfc.section.1.1.p.2">This document defines conformance criteria for several roles in HTTP communication, including Senders, Recipients, Clients, |
|---|
| 621 | Servers, User-Agents, Origin Servers, Intermediaries, Proxies and Gateways. See <a href="p1-messaging.html#architecture" title="Architecture">Section 2</a> of <a href="#Part1" id="rfc.xref.Part1.1"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a> for definitions of these terms. |
|---|
| 622 | </p> |
|---|
| 623 | <p id="rfc.section.1.1.p.3">An implementation is considered conformant if it complies with all of the requirements associated with its role(s). Note that |
|---|
| 624 | SHOULD-level requirements are relevant here, unless one of the documented exceptions is applicable. |
|---|
| 625 | </p> |
|---|
| 626 | <p id="rfc.section.1.1.p.4">This document also uses ABNF to define valid protocol elements (<a href="#notation" title="Syntax Notation">Section 1.2</a>). In addition to the prose requirements placed upon them, Senders <em class="bcp14">MUST NOT</em> generate protocol elements that are invalid. |
|---|
| 627 | </p> |
|---|
| 628 | <p id="rfc.section.1.1.p.5">Unless noted otherwise, Recipients <em class="bcp14">MAY</em> take steps to recover a usable protocol element from an invalid construct. However, HTTP does not define specific error handling |
|---|
| 629 | mechanisms, except in cases where it has direct impact on security. This is because different uses of the protocol require |
|---|
| 630 | different error handling strategies; for example, a Web browser may wish to transparently recover from a response where the |
|---|
| 631 | Location header field doesn't parse according to the ABNF, whereby in a systems control protocol using HTTP, this type of |
|---|
| 632 | error recovery could lead to dangerous consequences. |
|---|
| 633 | </p> |
|---|
| 634 | <h2 id="rfc.section.1.2"><a href="#rfc.section.1.2">1.2</a> <a id="notation" href="#notation">Syntax Notation</a></h2> |
|---|
| 635 | <p id="rfc.section.1.2.p.1">This specification uses the ABNF syntax defined in <a href="p1-messaging.html#notation" title="Syntax Notation">Section 1.2</a> of <a href="#Part1" id="rfc.xref.Part1.2"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a> (which extends the syntax defined in <a href="#RFC5234" id="rfc.xref.RFC5234.1"><cite title="Augmented BNF for Syntax Specifications: ABNF">[RFC5234]</cite></a> with a list rule). <a href="#collected.abnf" title="Collected ABNF">Appendix B</a> shows the collected ABNF, with the list rule expanded. |
|---|
| 636 | </p> |
|---|
| 637 | <p id="rfc.section.1.2.p.2">The following core rules are included by reference, as defined in <a href="#RFC5234" id="rfc.xref.RFC5234.2"><cite title="Augmented BNF for Syntax Specifications: ABNF">[RFC5234]</cite></a>, <a href="http://tools.ietf.org/html/rfc5234#appendix-B.1">Appendix B.1</a>: ALPHA (letters), CR (carriage return), CRLF (CR LF), CTL (controls), DIGIT (decimal 0-9), DQUOTE (double quote), HEXDIG |
|---|
| 638 | (hexadecimal 0-9/A-F/a-f), LF (line feed), OCTET (any 8-bit sequence of data), SP (space), and VCHAR (any visible US-ASCII |
|---|
| 639 | character). |
|---|
| 640 | </p> |
|---|
| 641 | <h3 id="rfc.section.1.2.1"><a href="#rfc.section.1.2.1">1.2.1</a> <a id="core.rules" href="#core.rules">Core Rules</a></h3> |
|---|
| 642 | <p id="rfc.section.1.2.1.p.1">The core rules below are defined in <a href="#Part1" id="rfc.xref.Part1.3"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>: |
|---|
| 643 | </p> |
|---|
| 644 | <div id="rfc.figure.u.1"></div><pre class="inline"> <a href="#core.rules" class="smpl">BWS</a> = <BWS, defined in <a href="#Part1" id="rfc.xref.Part1.4"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#basic.rules" title="Basic Rules">Section 1.2.2</a>> |
|---|
| 645 | <a href="#core.rules" class="smpl">OWS</a> = <OWS, defined in <a href="#Part1" id="rfc.xref.Part1.5"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#basic.rules" title="Basic Rules">Section 1.2.2</a>> |
|---|
| 646 | <a href="#core.rules" class="smpl">quoted-string</a> = <quoted-string, defined in <a href="#Part1" id="rfc.xref.Part1.6"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#field.rules" title="Common Field ABNF Rules">Section 3.2.3</a>> |
|---|
| 647 | <a href="#core.rules" class="smpl">token</a> = <token, defined in <a href="#Part1" id="rfc.xref.Part1.7"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#field.rules" title="Common Field ABNF Rules">Section 3.2.3</a>> |
|---|
| 648 | </pre><h1 id="rfc.section.2"><a href="#rfc.section.2">2.</a> <a id="access.authentication.framework" href="#access.authentication.framework">Access Authentication Framework</a></h1> |
|---|
| 649 | <h2 id="rfc.section.2.1"><a href="#rfc.section.2.1">2.1</a> <a id="challenge.and.response" href="#challenge.and.response">Challenge and Response</a></h2> |
|---|
| 650 | <p id="rfc.section.2.1.p.1">HTTP provides a simple challenge-response authentication mechanism that can be used by a server to challenge a client request |
|---|
| 651 | and by a client to provide authentication information. It uses an extensible, case-insensitive token to identify the authentication |
|---|
| 652 | scheme, followed by additional information necessary for achieving authentication via that scheme. The latter can either be |
|---|
| 653 | a comma-separated list of parameters or a single sequence of characters capable of holding base64-encoded information. |
|---|
| 654 | </p> |
|---|
| 655 | <p id="rfc.section.2.1.p.2">Parameters are name-value pairs where the name is matched case-insensitively, and each parameter name <em class="bcp14">MUST</em> only occur once per challenge. |
|---|
| 656 | </p> |
|---|
| 657 | <div id="rfc.figure.u.2"></div><pre class="inline"><span id="rfc.iref.a.1"></span><span id="rfc.iref.a.2"></span><span id="rfc.iref.g.1"></span><span id="rfc.iref.g.2"></span><span id="rfc.iref.b.1"></span><span id="rfc.iref.g.3"></span> auth-scheme = <a href="#core.rules" class="smpl">token</a> |
|---|
| 658 | |
|---|
| 659 | auth-param = <a href="#core.rules" class="smpl">token</a> <a href="#core.rules" class="smpl">BWS</a> "=" <a href="#core.rules" class="smpl">BWS</a> ( <a href="#core.rules" class="smpl">token</a> / <a href="#core.rules" class="smpl">quoted-string</a> ) |
|---|
| 660 | |
|---|
| 661 | b64token = 1*( <a href="#notation" class="smpl">ALPHA</a> / <a href="#notation" class="smpl">DIGIT</a> / |
|---|
| 662 | "-" / "." / "_" / "~" / "+" / "/" ) *"=" |
|---|
| 663 | </pre><p id="rfc.section.2.1.p.4">The "b64token" syntax allows the 66 unreserved URI characters (<a href="#RFC3986" id="rfc.xref.RFC3986.1"><cite title="Uniform Resource Identifier (URI): Generic Syntax">[RFC3986]</cite></a>), plus a few others, so that it can hold a base64, base64url (URL and filename safe alphabet), base32, or base16 (hex) encoding, |
|---|
| 664 | with or without padding, but excluding whitespace (<a href="#RFC4648" id="rfc.xref.RFC4648.1"><cite title="The Base16, Base32, and Base64 Data Encodings">[RFC4648]</cite></a>). |
|---|
| 665 | </p> |
|---|
| 666 | <p id="rfc.section.2.1.p.5">The 401 (Unauthorized) response message is used by an origin server to challenge the authorization of a user agent. This response <em class="bcp14">MUST</em> include a WWW-Authenticate header field containing at least one challenge applicable to the requested resource. |
|---|
| 667 | </p> |
|---|
| 668 | <p id="rfc.section.2.1.p.6">The 407 (Proxy Authentication Required) response message is used by a proxy to challenge the authorization of a client and <em class="bcp14">MUST</em> include a Proxy-Authenticate header field containing at least one challenge applicable to the proxy for the requested resource. |
|---|
| 669 | </p> |
|---|
| 670 | <div id="rfc.figure.u.3"></div><pre class="inline"><span id="rfc.iref.c.1"></span><span id="rfc.iref.g.4"></span> <a href="#challenge.and.response" class="smpl">challenge</a> = <a href="#challenge.and.response" class="smpl">auth-scheme</a> [ 1*<a href="#notation" class="smpl">SP</a> ( <a href="#challenge.and.response" class="smpl">b64token</a> / #<a href="#challenge.and.response" class="smpl">auth-param</a> ) ] |
|---|
| 671 | </pre><div class="note" id="rfc.section.2.1.p.8"> |
|---|
| 672 | <p> <b>Note:</b> User agents will need to take special care in parsing the WWW-Authenticate and Proxy-Authenticate header field values because |
|---|
| 673 | they can contain more than one challenge, or if more than one of each is provided, since the contents of a challenge can itself |
|---|
| 674 | contain a comma-separated list of authentication parameters. |
|---|
| 675 | </p> |
|---|
| 676 | </div> |
|---|
| 677 | <div class="note" id="rfc.section.2.1.p.9"> |
|---|
| 678 | <p> <b>Note:</b> Many browsers fail to parse challenges containing unknown schemes. A workaround for this problem is to list well-supported |
|---|
| 679 | schemes (such as "basic") first. |
|---|
| 680 | </p> |
|---|
| 681 | </div> |
|---|
| 682 | <p id="rfc.section.2.1.p.10">A user agent that wishes to authenticate itself with an origin server — usually, but not necessarily, after receiving a 401 |
|---|
| 683 | (Unauthorized) — <em class="bcp14">MAY</em> do so by including an Authorization header field with the request. |
|---|
| 684 | </p> |
|---|
| 685 | <p id="rfc.section.2.1.p.11">A client that wishes to authenticate itself with a proxy — usually, but not necessarily, after receiving a 407 (Proxy Authentication |
|---|
| 686 | Required) — <em class="bcp14">MAY</em> do so by including a Proxy-Authorization header field with the request. |
|---|
| 687 | </p> |
|---|
| 688 | <p id="rfc.section.2.1.p.12">Both the Authorization field value and the Proxy-Authorization field value consist of credentials containing the authentication |
|---|
| 689 | information of the client for the realm of the resource being requested. The user agent <em class="bcp14">MUST</em> choose to use one of the challenges with the strongest auth-scheme it understands and request credentials from the user based |
|---|
| 690 | upon that challenge. |
|---|
| 691 | </p> |
|---|
| 692 | <div id="rfc.figure.u.4"></div><pre class="inline"><span id="rfc.iref.c.2"></span><span id="rfc.iref.g.5"></span> <a href="#challenge.and.response" class="smpl">credentials</a> = <a href="#challenge.and.response" class="smpl">auth-scheme</a> [ 1*<a href="#notation" class="smpl">SP</a> ( <a href="#challenge.and.response" class="smpl">b64token</a> / #<a href="#challenge.and.response" class="smpl">auth-param</a> ) ] |
|---|
| 693 | </pre><p id="rfc.section.2.1.p.14">If the origin server does not wish to accept the credentials sent with a request, it <em class="bcp14">SHOULD</em> return a 401 (Unauthorized) response. The response <em class="bcp14">MUST</em> include a WWW-Authenticate header field containing at least one (possibly new) challenge applicable to the requested resource. |
|---|
| 694 | </p> |
|---|
| 695 | <p id="rfc.section.2.1.p.15">If a proxy does not accept the credentials sent with a request, it <em class="bcp14">SHOULD</em> return a 407 (Proxy Authentication Required). The response <em class="bcp14">MUST</em> include a Proxy-Authenticate header field containing a (possibly new) challenge applicable to the proxy for the requested |
|---|
| 696 | resource. |
|---|
| 697 | </p> |
|---|
| 698 | <p id="rfc.section.2.1.p.16">The HTTP protocol does not restrict applications to this simple challenge-response mechanism for access authentication. Additional |
|---|
| 699 | mechanisms <em class="bcp14">MAY</em> be used, such as encryption at the transport level or via message encapsulation, and with additional header fields specifying |
|---|
| 700 | authentication information. However, such additional mechanisms are not defined by this specification. |
|---|
| 701 | </p> |
|---|
| 702 | <p id="rfc.section.2.1.p.17">Proxies <em class="bcp14">MUST</em> forward the WWW-Authenticate and Authorization headers unmodified and follow the rules found in <a href="#header.authorization" id="rfc.xref.header.authorization.1" title="Authorization">Section 4.1</a>. |
|---|
| 703 | </p> |
|---|
| 704 | <div id="rfc.iref.p.1"></div> |
|---|
| 705 | <div id="rfc.iref.r.1"></div> |
|---|
| 706 | <h2 id="rfc.section.2.2"><a href="#rfc.section.2.2">2.2</a> <a id="protection.space" href="#protection.space">Protection Space (Realm)</a></h2> |
|---|
| 707 | <p id="rfc.section.2.2.p.1">The authentication parameter realm is reserved for use by authentication schemes that wish to indicate the scope of protection.</p> |
|---|
| 708 | <p id="rfc.section.2.2.p.2">A <dfn>protection space</dfn> is defined by the canonical root URI (the scheme and authority components of the effective request URI; see <a href="p1-messaging.html#effective.request.uri" title="Effective Request URI">Section 4.3</a> of <a href="#Part1" id="rfc.xref.Part1.8"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>) of the server being accessed, in combination with the realm value if present. These realms allow the protected resources |
|---|
| 709 | on a server to be partitioned into a set of protection spaces, each with its own authentication scheme and/or authorization |
|---|
| 710 | database. The realm value is a string, generally assigned by the origin server, which can have additional semantics specific |
|---|
| 711 | to the authentication scheme. Note that there can be multiple challenges with the same auth-scheme but different realms. |
|---|
| 712 | </p> |
|---|
| 713 | <p id="rfc.section.2.2.p.3">The protection space determines the domain over which credentials can be automatically applied. If a prior request has been |
|---|
| 714 | authorized, the same credentials <em class="bcp14">MAY</em> be reused for all other requests within that protection space for a period of time determined by the authentication scheme, |
|---|
| 715 | parameters, and/or user preference. Unless otherwise defined by the authentication scheme, a single protection space cannot |
|---|
| 716 | extend outside the scope of its server. |
|---|
| 717 | </p> |
|---|
| 718 | <p id="rfc.section.2.2.p.4">For historical reasons, senders <em class="bcp14">MUST</em> only use the quoted-string syntax. Recipients might have to support both token and quoted-string syntax for maximum interoperability |
|---|
| 719 | with existing clients that have been accepting both notations for a long time. |
|---|
| 720 | </p> |
|---|
| 721 | <h2 id="rfc.section.2.3"><a href="#rfc.section.2.3">2.3</a> <a id="authentication.scheme.registry" href="#authentication.scheme.registry">Authentication Scheme Registry</a></h2> |
|---|
| 722 | <p id="rfc.section.2.3.p.1">The HTTP Authentication Scheme Registry defines the name space for the authentication schemes in challenges and credentials.</p> |
|---|
| 723 | <p id="rfc.section.2.3.p.2">Registrations <em class="bcp14">MUST</em> include the following fields: |
|---|
| 724 | </p> |
|---|
| 725 | <ul> |
|---|
| 726 | <li>Authentication Scheme Name</li> |
|---|
| 727 | <li>Pointer to specification text</li> |
|---|
| 728 | <li>Notes (optional)</li> |
|---|
| 729 | </ul> |
|---|
| 730 | <p id="rfc.section.2.3.p.3">Values to be added to this name space are subject to IETF review (<a href="#RFC5226" id="rfc.xref.RFC5226.1"><cite title="Guidelines for Writing an IANA Considerations Section in RFCs">[RFC5226]</cite></a>, <a href="http://tools.ietf.org/html/rfc5226#section-4.1">Section 4.1</a>). |
|---|
| 731 | </p> |
|---|
| 732 | <p id="rfc.section.2.3.p.4">The registry itself is maintained at <<a href="http://www.iana.org/assignments/http-authschemes">http://www.iana.org/assignments/http-authschemes</a>>. |
|---|
| 733 | </p> |
|---|
| 734 | <h3 id="rfc.section.2.3.1"><a href="#rfc.section.2.3.1">2.3.1</a> <a id="considerations.for.new.authentication.schemes" href="#considerations.for.new.authentication.schemes">Considerations for New Authentication Schemes</a></h3> |
|---|
| 735 | <p id="rfc.section.2.3.1.p.1">There are certain aspects of the HTTP Authentication Framework that put constraints on how new authentication schemes can |
|---|
| 736 | work: |
|---|
| 737 | </p> |
|---|
| 738 | <p id="rfc.section.2.3.1.p.2"> </p> |
|---|
| 739 | <ul> |
|---|
| 740 | <li> |
|---|
| 741 | <p>Authentication schemes need to be compatible with the inherent constraints of HTTP; for instance, that messages need to keep |
|---|
| 742 | their semantics when inspected in isolation, thus an authentication scheme can not bind information to the TCP session over |
|---|
| 743 | which the message was received (see <a href="p1-messaging.html#message-orientation-and-buffering" title="Message Orientation and Buffering">Section 2.2</a> of <a href="#Part1" id="rfc.xref.Part1.9"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). |
|---|
| 744 | </p> |
|---|
| 745 | </li> |
|---|
| 746 | <li> |
|---|
| 747 | <p>The authentication parameter "realm" is reserved for defining Protection Spaces as defined in <a href="#protection.space" title="Protection Space (Realm)">Section 2.2</a>. New schemes <em class="bcp14">MUST NOT</em> use it in a way incompatible with that definition. |
|---|
| 748 | </p> |
|---|
| 749 | </li> |
|---|
| 750 | <li> |
|---|
| 751 | <p>The "b64token" notation was introduced for compatibility with existing authentication schemes and can only be used once per |
|---|
| 752 | challenge/credentials. New schemes thus ought to use the "auth-param" syntax instead, because otherwise future extensions |
|---|
| 753 | will be impossible. |
|---|
| 754 | </p> |
|---|
| 755 | </li> |
|---|
| 756 | <li> |
|---|
| 757 | <p>The parsing of challenges and credentials is defined by this specification, and cannot be modified by new authentication schemes. |
|---|
| 758 | When the auth-param syntax is used, all parameters ought to support both token and quoted-string syntax, and syntactical constraints |
|---|
| 759 | ought to be defined on the field value after parsing (i.e., quoted-string processing). This is necessary so that recipients |
|---|
| 760 | can use a generic parser that applies to all authentication schemes. |
|---|
| 761 | </p> |
|---|
| 762 | <p> <b>Note:</b> the fact that the value syntax for the "realm" parameter is restricted to quoted-string was a bad design choice not to be |
|---|
| 763 | repeated for new parameters. |
|---|
| 764 | </p> |
|---|
| 765 | </li> |
|---|
| 766 | <li> |
|---|
| 767 | <p>Authentication schemes need to document whether they are usable in origin-server authentication (i.e., using WWW-Authenticate), |
|---|
| 768 | and/or proxy authentication (i.e., using Proxy-Authenticate). |
|---|
| 769 | </p> |
|---|
| 770 | </li> |
|---|
| 771 | <li> |
|---|
| 772 | <p>The credentials carried in an Authorization header field are specific to the User Agent, and therefore have the same effect |
|---|
| 773 | on HTTP caches as the "private" Cache-Control response directive, within the scope of the request they appear in. |
|---|
| 774 | </p> |
|---|
| 775 | <p>Therefore, new authentication schemes which choose not to carry credentials in the Authorization header (e.g., using a newly |
|---|
| 776 | defined header) will need to explicitly disallow caching, by mandating the use of either Cache-Control request directives |
|---|
| 777 | (e.g., "no-store") or response directives (e.g., "private"). |
|---|
| 778 | </p> |
|---|
| 779 | </li> |
|---|
| 780 | </ul> |
|---|
| 781 | <h1 id="rfc.section.3"><a href="#rfc.section.3">3.</a> <a id="status.code.definitions" href="#status.code.definitions">Status Code Definitions</a></h1> |
|---|
| 782 | <div id="rfc.iref.12"></div> |
|---|
| 783 | <div id="rfc.iref.s.1"></div> |
|---|
| 784 | <h2 id="rfc.section.3.1"><a href="#rfc.section.3.1">3.1</a> <a id="status.401" href="#status.401">401 Unauthorized</a></h2> |
|---|
| 785 | <p id="rfc.section.3.1.p.1">The request requires user authentication. The response <em class="bcp14">MUST</em> include a WWW-Authenticate header field (<a href="#header.www-authenticate" id="rfc.xref.header.www-authenticate.1" title="WWW-Authenticate">Section 4.4</a>) containing a challenge applicable to the target resource. The client <em class="bcp14">MAY</em> repeat the request with a suitable Authorization header field (<a href="#header.authorization" id="rfc.xref.header.authorization.2" title="Authorization">Section 4.1</a>). If the request already included Authorization credentials, then the 401 response indicates that authorization has been |
|---|
| 786 | refused for those credentials. If the 401 response contains the same challenge as the prior response, and the user agent has |
|---|
| 787 | already attempted authentication at least once, then the user <em class="bcp14">SHOULD</em> be presented the representation that was given in the response, since that representation might include relevant diagnostic |
|---|
| 788 | information. |
|---|
| 789 | </p> |
|---|
| 790 | <div id="rfc.iref.13"></div> |
|---|
| 791 | <div id="rfc.iref.s.2"></div> |
|---|
| 792 | <h2 id="rfc.section.3.2"><a href="#rfc.section.3.2">3.2</a> <a id="status.407" href="#status.407">407 Proxy Authentication Required</a></h2> |
|---|
| 793 | <p id="rfc.section.3.2.p.1">This code is similar to 401 (Unauthorized), but indicates that the client ought to first authenticate itself with the proxy. |
|---|
| 794 | The proxy <em class="bcp14">MUST</em> return a Proxy-Authenticate header field (<a href="#header.proxy-authenticate" id="rfc.xref.header.proxy-authenticate.1" title="Proxy-Authenticate">Section 4.2</a>) containing a challenge applicable to the proxy for the target resource. The client <em class="bcp14">MAY</em> repeat the request with a suitable Proxy-Authorization header field (<a href="#header.proxy-authorization" id="rfc.xref.header.proxy-authorization.1" title="Proxy-Authorization">Section 4.3</a>). |
|---|
| 795 | </p> |
|---|
| 796 | <h1 id="rfc.section.4"><a href="#rfc.section.4">4.</a> <a id="header.field.definitions" href="#header.field.definitions">Header Field Definitions</a></h1> |
|---|
| 797 | <p id="rfc.section.4.p.1">This section defines the syntax and semantics of HTTP/1.1 header fields related to authentication.</p> |
|---|
| 798 | <div id="rfc.iref.a.3"></div> |
|---|
| 799 | <div id="rfc.iref.h.1"></div> |
|---|
| 800 | <h2 id="rfc.section.4.1"><a href="#rfc.section.4.1">4.1</a> <a id="header.authorization" href="#header.authorization">Authorization</a></h2> |
|---|
| 801 | <p id="rfc.section.4.1.p.1">The "Authorization" header field allows a user agent to authenticate itself with a server — usually, but not necessarily, |
|---|
| 802 | after receiving a 401 (Unauthorized) response. Its value consists of credentials containing information of the user agent |
|---|
| 803 | for the realm of the resource being requested. |
|---|
| 804 | </p> |
|---|
| 805 | <div id="rfc.figure.u.5"></div><pre class="inline"><span id="rfc.iref.g.6"></span> <a href="#header.authorization" class="smpl">Authorization</a> = <a href="#challenge.and.response" class="smpl">credentials</a> |
|---|
| 806 | </pre><p id="rfc.section.4.1.p.3">If a request is authenticated and a realm specified, the same credentials <em class="bcp14">SHOULD</em> be valid for all other requests within this realm (assuming that the authentication scheme itself does not require otherwise, |
|---|
| 807 | such as credentials that vary according to a challenge value or using synchronized clocks). |
|---|
| 808 | </p> |
|---|
| 809 | <p id="rfc.section.4.1.p.4">When a shared cache (see <a href="p6-cache.html#shared.and.non-shared.caches">Section 1.2</a> of <a href="#Part6" id="rfc.xref.Part6.1"><cite title="HTTP/1.1, part 6: Caching">[Part6]</cite></a>) receives a request containing an Authorization field, it <em class="bcp14">MUST NOT</em> return the corresponding response as a reply to any other request, unless one of the following specific exceptions holds: |
|---|
| 810 | </p> |
|---|
| 811 | <p id="rfc.section.4.1.p.5"> </p> |
|---|
| 812 | <ol> |
|---|
| 813 | <li>If the response includes the "s-maxage" cache-control directive, the cache <em class="bcp14">MAY</em> use that response in replying to a subsequent request. But (if the specified maximum age has passed) a proxy cache <em class="bcp14">MUST</em> first revalidate it with the origin server, using the header fields from the new request to allow the origin server to authenticate |
|---|
| 814 | the new request. (This is the defined behavior for s-maxage.) If the response includes "s-maxage=0", the proxy <em class="bcp14">MUST</em> always revalidate it before re-using it. |
|---|
| 815 | </li> |
|---|
| 816 | <li>If the response includes the "must-revalidate" cache-control directive, the cache <em class="bcp14">MAY</em> use that response in replying to a subsequent request. But if the response is stale, all caches <em class="bcp14">MUST</em> first revalidate it with the origin server, using the header fields from the new request to allow the origin server to authenticate |
|---|
| 817 | the new request. |
|---|
| 818 | </li> |
|---|
| 819 | <li>If the response includes the "public" cache-control directive, it <em class="bcp14">MAY</em> be returned in reply to any subsequent request. |
|---|
| 820 | </li> |
|---|
| 821 | </ol> |
|---|
| 822 | <div id="rfc.iref.p.2"></div> |
|---|
| 823 | <div id="rfc.iref.h.2"></div> |
|---|
| 824 | <h2 id="rfc.section.4.2"><a href="#rfc.section.4.2">4.2</a> <a id="header.proxy-authenticate" href="#header.proxy-authenticate">Proxy-Authenticate</a></h2> |
|---|
| 825 | <p id="rfc.section.4.2.p.1">The "Proxy-Authenticate" header field consists of a challenge that indicates the authentication scheme and parameters applicable |
|---|
| 826 | to the proxy for this effective request URI (<a href="p1-messaging.html#effective.request.uri" title="Effective Request URI">Section 4.3</a> of <a href="#Part1" id="rfc.xref.Part1.10"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). It <em class="bcp14">MUST</em> be included as part of a 407 (Proxy Authentication Required) response. |
|---|
| 827 | </p> |
|---|
| 828 | <div id="rfc.figure.u.6"></div><pre class="inline"><span id="rfc.iref.g.7"></span> <a href="#header.proxy-authenticate" class="smpl">Proxy-Authenticate</a> = 1#<a href="#challenge.and.response" class="smpl">challenge</a> |
|---|
| 829 | </pre><p id="rfc.section.4.2.p.3">Unlike WWW-Authenticate, the Proxy-Authenticate header field applies only to the current connection and <em class="bcp14">SHOULD NOT</em> be passed on to downstream clients. However, an intermediate proxy might need to obtain its own credentials by requesting |
|---|
| 830 | them from the downstream client, which in some circumstances will appear as if the proxy is forwarding the Proxy-Authenticate |
|---|
| 831 | header field. |
|---|
| 832 | </p> |
|---|
| 833 | <div id="rfc.iref.p.3"></div> |
|---|
| 834 | <div id="rfc.iref.h.3"></div> |
|---|
| 835 | <h2 id="rfc.section.4.3"><a href="#rfc.section.4.3">4.3</a> <a id="header.proxy-authorization" href="#header.proxy-authorization">Proxy-Authorization</a></h2> |
|---|
| 836 | <p id="rfc.section.4.3.p.1">The "Proxy-Authorization" header field allows the client to identify itself (or its user) to a proxy which requires authentication. |
|---|
| 837 | Its value consists of credentials containing the authentication information of the user agent for the proxy and/or realm of |
|---|
| 838 | the resource being requested. |
|---|
| 839 | </p> |
|---|
| 840 | <div id="rfc.figure.u.7"></div><pre class="inline"><span id="rfc.iref.g.8"></span> <a href="#header.proxy-authorization" class="smpl">Proxy-Authorization</a> = <a href="#challenge.and.response" class="smpl">credentials</a> |
|---|
| 841 | </pre><p id="rfc.section.4.3.p.3">Unlike Authorization, the Proxy-Authorization header field applies only to the next outbound proxy that demanded authentication |
|---|
| 842 | using the Proxy-Authenticate field. When multiple proxies are used in a chain, the Proxy-Authorization header field is consumed |
|---|
| 843 | by the first outbound proxy that was expecting to receive credentials. A proxy <em class="bcp14">MAY</em> relay the credentials from the client request to the next proxy if that is the mechanism by which the proxies cooperatively |
|---|
| 844 | authenticate a given request. |
|---|
| 845 | </p> |
|---|
| 846 | <div id="rfc.iref.w.1"></div> |
|---|
| 847 | <div id="rfc.iref.h.4"></div> |
|---|
| 848 | <h2 id="rfc.section.4.4"><a href="#rfc.section.4.4">4.4</a> <a id="header.www-authenticate" href="#header.www-authenticate">WWW-Authenticate</a></h2> |
|---|
| 849 | <p id="rfc.section.4.4.p.1">The "WWW-Authenticate" header field consists of at least one challenge that indicates the authentication scheme(s) and parameters |
|---|
| 850 | applicable to the effective request URI (<a href="p1-messaging.html#effective.request.uri" title="Effective Request URI">Section 4.3</a> of <a href="#Part1" id="rfc.xref.Part1.11"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). |
|---|
| 851 | </p> |
|---|
| 852 | <p id="rfc.section.4.4.p.2">It <em class="bcp14">MUST</em> be included in 401 (Unauthorized) response messages and <em class="bcp14">MAY</em> be included in other response messages to indicate that supplying credentials (or different credentials) might affect the |
|---|
| 853 | response. |
|---|
| 854 | </p> |
|---|
| 855 | <div id="rfc.figure.u.8"></div><pre class="inline"><span id="rfc.iref.g.9"></span> <a href="#header.www-authenticate" class="smpl">WWW-Authenticate</a> = 1#<a href="#challenge.and.response" class="smpl">challenge</a> |
|---|
| 856 | </pre><p id="rfc.section.4.4.p.4">User agents are advised to take special care in parsing the WWW-Authenticate field value as it might contain more than one |
|---|
| 857 | challenge, or if more than one WWW-Authenticate header field is provided, the contents of a challenge itself can contain a |
|---|
| 858 | comma-separated list of authentication parameters. |
|---|
| 859 | </p> |
|---|
| 860 | <div id="rfc.figure.u.9"></div> |
|---|
| 861 | <p>For instance:</p> <pre class="text"> WWW-Authenticate: Newauth realm="apps", type=1, |
|---|
| 862 | title="Login to \"apps\"", Basic realm="simple" |
|---|
| 863 | </pre> <p>This header field contains two challenges; one for the "Newauth" scheme with a realm value of "apps", and two additional parameters |
|---|
| 864 | "type" and "title", and another one for the "Basic" scheme with a realm value of "simple". |
|---|
| 865 | </p> |
|---|
| 866 | <h1 id="rfc.section.5"><a href="#rfc.section.5">5.</a> <a id="IANA.considerations" href="#IANA.considerations">IANA Considerations</a></h1> |
|---|
| 867 | <h2 id="rfc.section.5.1"><a href="#rfc.section.5.1">5.1</a> <a id="authentication.scheme.registration" href="#authentication.scheme.registration">Authenticaton Scheme Registry</a></h2> |
|---|
| 868 | <p id="rfc.section.5.1.p.1">The registration procedure for HTTP Authentication Schemes is defined by <a href="#authentication.scheme.registry" title="Authentication Scheme Registry">Section 2.3</a> of this document. |
|---|
| 869 | </p> |
|---|
| 870 | <p id="rfc.section.5.1.p.2">The HTTP Method Authentication Scheme shall be created at <<a href="http://www.iana.org/assignments/http-authschemes">http://www.iana.org/assignments/http-authschemes</a>>. |
|---|
| 871 | </p> |
|---|
| 872 | <h2 id="rfc.section.5.2"><a href="#rfc.section.5.2">5.2</a> <a id="status.code.registration" href="#status.code.registration">Status Code Registration</a></h2> |
|---|
| 873 | <p id="rfc.section.5.2.p.1">The HTTP Status Code Registry located at <<a href="http://www.iana.org/assignments/http-status-codes">http://www.iana.org/assignments/http-status-codes</a>> shall be updated with the registrations below: |
|---|
| 874 | </p> |
|---|
| 875 | <div id="rfc.table.1"> |
|---|
| 876 | <div id="iana.status.code.registration.table"></div> |
|---|
| 877 | <table class="tt full left" cellpadding="3" cellspacing="0"> |
|---|
| 878 | <thead> |
|---|
| 879 | <tr> |
|---|
| 880 | <th>Value</th> |
|---|
| 881 | <th>Description</th> |
|---|
| 882 | <th>Reference</th> |
|---|
| 883 | </tr> |
|---|
| 884 | </thead> |
|---|
| 885 | <tbody> |
|---|
| 886 | <tr> |
|---|
| 887 | <td class="left">401</td> |
|---|
| 888 | <td class="left">Unauthorized</td> |
|---|
| 889 | <td class="left"> <a href="#status.401" id="rfc.xref.status.401.1" title="401 Unauthorized">Section 3.1</a> |
|---|
| 890 | </td> |
|---|
| 891 | </tr> |
|---|
| 892 | <tr> |
|---|
| 893 | <td class="left">407</td> |
|---|
| 894 | <td class="left">Proxy Authentication Required</td> |
|---|
| 895 | <td class="left"> <a href="#status.407" id="rfc.xref.status.407.1" title="407 Proxy Authentication Required">Section 3.2</a> |
|---|
| 896 | </td> |
|---|
| 897 | </tr> |
|---|
| 898 | </tbody> |
|---|
| 899 | </table> |
|---|
| 900 | </div> |
|---|
| 901 | <h2 id="rfc.section.5.3"><a href="#rfc.section.5.3">5.3</a> <a id="header.field.registration" href="#header.field.registration">Header Field Registration</a></h2> |
|---|
| 902 | <p id="rfc.section.5.3.p.1">The Message Header Field Registry located at <<a href="http://www.iana.org/assignments/message-headers/message-header-index.html">http://www.iana.org/assignments/message-headers/message-header-index.html</a>> shall be updated with the permanent registrations below (see <a href="#RFC3864" id="rfc.xref.RFC3864.1"><cite title="Registration Procedures for Message Header Fields">[RFC3864]</cite></a>): |
|---|
| 903 | </p> |
|---|
| 904 | <div id="rfc.table.2"> |
|---|
| 905 | <div id="iana.header.registration.table"></div> |
|---|
| 906 | <table class="tt full left" cellpadding="3" cellspacing="0"> |
|---|
| 907 | <thead> |
|---|
| 908 | <tr> |
|---|
| 909 | <th>Header Field Name</th> |
|---|
| 910 | <th>Protocol</th> |
|---|
| 911 | <th>Status</th> |
|---|
| 912 | <th>Reference</th> |
|---|
| 913 | </tr> |
|---|
| 914 | </thead> |
|---|
| 915 | <tbody> |
|---|
| 916 | <tr> |
|---|
| 917 | <td class="left">Authorization</td> |
|---|
| 918 | <td class="left">http</td> |
|---|
| 919 | <td class="left">standard</td> |
|---|
| 920 | <td class="left"> <a href="#header.authorization" id="rfc.xref.header.authorization.3" title="Authorization">Section 4.1</a> |
|---|
| 921 | </td> |
|---|
| 922 | </tr> |
|---|
| 923 | <tr> |
|---|
| 924 | <td class="left">Proxy-Authenticate</td> |
|---|
| 925 | <td class="left">http</td> |
|---|
| 926 | <td class="left">standard</td> |
|---|
| 927 | <td class="left"> <a href="#header.proxy-authenticate" id="rfc.xref.header.proxy-authenticate.2" title="Proxy-Authenticate">Section 4.2</a> |
|---|
| 928 | </td> |
|---|
| 929 | </tr> |
|---|
| 930 | <tr> |
|---|
| 931 | <td class="left">Proxy-Authorization</td> |
|---|
| 932 | <td class="left">http</td> |
|---|
| 933 | <td class="left">standard</td> |
|---|
| 934 | <td class="left"> <a href="#header.proxy-authorization" id="rfc.xref.header.proxy-authorization.2" title="Proxy-Authorization">Section 4.3</a> |
|---|
| 935 | </td> |
|---|
| 936 | </tr> |
|---|
| 937 | <tr> |
|---|
| 938 | <td class="left">WWW-Authenticate</td> |
|---|
| 939 | <td class="left">http</td> |
|---|
| 940 | <td class="left">standard</td> |
|---|
| 941 | <td class="left"> <a href="#header.www-authenticate" id="rfc.xref.header.www-authenticate.2" title="WWW-Authenticate">Section 4.4</a> |
|---|
| 942 | </td> |
|---|
| 943 | </tr> |
|---|
| 944 | </tbody> |
|---|
| 945 | </table> |
|---|
| 946 | </div> |
|---|
| 947 | <p id="rfc.section.5.3.p.2">The change controller is: "IETF (iesg@ietf.org) - Internet Engineering Task Force".</p> |
|---|
| 948 | <h1 id="rfc.section.6"><a href="#rfc.section.6">6.</a> <a id="security.considerations" href="#security.considerations">Security Considerations</a></h1> |
|---|
| 949 | <p id="rfc.section.6.p.1">This section is meant to inform application developers, information providers, and users of the security limitations in HTTP/1.1 |
|---|
| 950 | as described by this document. The discussion does not include definitive solutions to the problems revealed, though it does |
|---|
| 951 | make some suggestions for reducing security risks. |
|---|
| 952 | </p> |
|---|
| 953 | <h2 id="rfc.section.6.1"><a href="#rfc.section.6.1">6.1</a> <a id="auth.credentials.and.idle.clients" href="#auth.credentials.and.idle.clients">Authentication Credentials and Idle Clients</a></h2> |
|---|
| 954 | <p id="rfc.section.6.1.p.1">Existing HTTP clients and user agents typically retain authentication information indefinitely. HTTP/1.1 does not provide |
|---|
| 955 | a method for a server to direct clients to discard these cached credentials. This is a significant defect that requires further |
|---|
| 956 | extensions to HTTP. Circumstances under which credential caching can interfere with the application's security model include |
|---|
| 957 | but are not limited to: |
|---|
| 958 | </p> |
|---|
| 959 | <ul> |
|---|
| 960 | <li>Clients which have been idle for an extended period following which the server might wish to cause the client to reprompt |
|---|
| 961 | the user for credentials. |
|---|
| 962 | </li> |
|---|
| 963 | <li>Applications which include a session termination indication (such as a "logout" or "commit" button on a page) after which |
|---|
| 964 | the server side of the application "knows" that there is no further reason for the client to retain the credentials. |
|---|
| 965 | </li> |
|---|
| 966 | </ul> |
|---|
| 967 | <p id="rfc.section.6.1.p.2">This is currently under separate study. There are a number of work-arounds to parts of this problem, and we encourage the |
|---|
| 968 | use of password protection in screen savers, idle time-outs, and other methods which mitigate the security problems inherent |
|---|
| 969 | in this problem. In particular, user agents which cache credentials are encouraged to provide a readily accessible mechanism |
|---|
| 970 | for discarding cached credentials under user control. |
|---|
| 971 | </p> |
|---|
| 972 | <h1 id="rfc.section.7"><a href="#rfc.section.7">7.</a> <a id="acks" href="#acks">Acknowledgments</a></h1> |
|---|
| 973 | <p id="rfc.section.7.p.1">This specification takes over the definition of the HTTP Authentication Framework, previously defined in <cite title="HTTP Authentication: Basic and Digest Access Authentication" id="rfc.xref.RFC2617.3">RFC 2617</cite>. We thank John Franks, Phillip M. Hallam-Baker, Jeffery L. Hostetler, Scott D. Lawrence, Paul J. Leach, Ari Luotonen, and |
|---|
| 974 | Lawrence C. Stewart for their work on that specification. See <a href="http://tools.ietf.org/html/rfc2617#section-6">Section 6</a> of <a href="#RFC2617" id="rfc.xref.RFC2617.4"><cite title="HTTP Authentication: Basic and Digest Access Authentication">[RFC2617]</cite></a> for further acknowledgements. |
|---|
| 975 | </p> |
|---|
| 976 | <p id="rfc.section.7.p.2">See <a href="p1-messaging.html#acks" title="Acknowledgments">Section 11</a> of <a href="#Part1" id="rfc.xref.Part1.12"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a> for the Acknowledgments related to this document revision. |
|---|
| 977 | </p> |
|---|
| 978 | <h1 id="rfc.references"><a id="rfc.section.8" href="#rfc.section.8">8.</a> References |
|---|
| 979 | </h1> |
|---|
| 980 | <h2 id="rfc.references.1"><a href="#rfc.section.8.1" id="rfc.section.8.1">8.1</a> Normative References |
|---|
| 981 | </h2> |
|---|
| 982 | <table> |
|---|
| 983 | <tr> |
|---|
| 984 | <td class="reference"><b id="Part1">[Part1]</b></td> |
|---|
| 985 | <td class="top"><a href="mailto:fielding@gbiv.com" title="Adobe Systems Incorporated">Fielding, R., Ed.</a>, <a href="mailto:jg@freedesktop.org" title="Alcatel-Lucent Bell Labs">Gettys, J.</a>, <a href="mailto:JeffMogul@acm.org" title="Hewlett-Packard Company">Mogul, J.</a>, <a href="mailto:henrikn@microsoft.com" title="Microsoft Corporation">Frystyk, H.</a>, <a href="mailto:LMM@acm.org" title="Adobe Systems Incorporated">Masinter, L.</a>, <a href="mailto:paulle@microsoft.com" title="Microsoft Corporation">Leach, P.</a>, <a href="mailto:timbl@w3.org" title="World Wide Web Consortium">Berners-Lee, T.</a>, <a href="mailto:ylafon@w3.org" title="World Wide Web Consortium">Lafon, Y., Ed.</a>, and <a href="mailto:julian.reschke@greenbytes.de" title="greenbytes GmbH">J. Reschke, Ed.</a>, “<a href="http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-latest">HTTP/1.1, part 1: URIs, Connections, and Message Parsing</a>”, Internet-Draft draft-ietf-httpbis-p1-messaging-latest (work in progress), January 2012. |
|---|
| 986 | </td> |
|---|
| 987 | </tr> |
|---|
| 988 | <tr> |
|---|
| 989 | <td class="reference"><b id="Part6">[Part6]</b></td> |
|---|
| 990 | <td class="top"><a href="mailto:fielding@gbiv.com" title="Adobe Systems Incorporated">Fielding, R., Ed.</a>, <a href="mailto:jg@freedesktop.org" title="Alcatel-Lucent Bell Labs">Gettys, J.</a>, <a href="mailto:JeffMogul@acm.org" title="Hewlett-Packard Company">Mogul, J.</a>, <a href="mailto:henrikn@microsoft.com" title="Microsoft Corporation">Frystyk, H.</a>, <a href="mailto:LMM@acm.org" title="Adobe Systems Incorporated">Masinter, L.</a>, <a href="mailto:paulle@microsoft.com" title="Microsoft Corporation">Leach, P.</a>, <a href="mailto:timbl@w3.org" title="World Wide Web Consortium">Berners-Lee, T.</a>, <a href="mailto:ylafon@w3.org" title="World Wide Web Consortium">Lafon, Y., Ed.</a>, <a href="mailto:mnot@mnot.net" title="Rackspace">Nottingham, M., Ed.</a>, and <a href="mailto:julian.reschke@greenbytes.de" title="greenbytes GmbH">J. Reschke, Ed.</a>, “<a href="http://tools.ietf.org/html/draft-ietf-httpbis-p6-cache-latest">HTTP/1.1, part 6: Caching</a>”, Internet-Draft draft-ietf-httpbis-p6-cache-latest (work in progress), January 2012. |
|---|
| 991 | </td> |
|---|
| 992 | </tr> |
|---|
| 993 | <tr> |
|---|
| 994 | <td class="reference"><b id="RFC2119">[RFC2119]</b></td> |
|---|
| 995 | <td class="top"><a href="mailto:sob@harvard.edu" title="Harvard University">Bradner, S.</a>, “<a href="http://tools.ietf.org/html/rfc2119">Key words for use in RFCs to Indicate Requirement Levels</a>”, BCP 14, RFC 2119, March 1997. |
|---|
| 996 | </td> |
|---|
| 997 | </tr> |
|---|
| 998 | <tr> |
|---|
| 999 | <td class="reference"><b id="RFC5234">[RFC5234]</b></td> |
|---|
| 1000 | <td class="top"><a href="mailto:dcrocker@bbiw.net" title="Brandenburg InternetWorking">Crocker, D., Ed.</a> and <a href="mailto:paul.overell@thus.net" title="THUS plc.">P. Overell</a>, “<a href="http://tools.ietf.org/html/rfc5234">Augmented BNF for Syntax Specifications: ABNF</a>”, STD 68, RFC 5234, January 2008. |
|---|
| 1001 | </td> |
|---|
| 1002 | </tr> |
|---|
| 1003 | </table> |
|---|
| 1004 | <h2 id="rfc.references.2"><a href="#rfc.section.8.2" id="rfc.section.8.2">8.2</a> Informative References |
|---|
| 1005 | </h2> |
|---|
| 1006 | <table> |
|---|
| 1007 | <tr> |
|---|
| 1008 | <td class="reference"><b id="RFC2616">[RFC2616]</b></td> |
|---|
| 1009 | <td class="top"><a href="mailto:fielding@ics.uci.edu" title="University of California, Irvine">Fielding, R.</a>, <a href="mailto:jg@w3.org" title="W3C">Gettys, J.</a>, <a href="mailto:mogul@wrl.dec.com" title="Compaq Computer Corporation">Mogul, J.</a>, <a href="mailto:frystyk@w3.org" title="MIT Laboratory for Computer Science">Frystyk, H.</a>, <a href="mailto:masinter@parc.xerox.com" title="Xerox Corporation">Masinter, L.</a>, <a href="mailto:paulle@microsoft.com" title="Microsoft Corporation">Leach, P.</a>, and <a href="mailto:timbl@w3.org" title="W3C">T. Berners-Lee</a>, “<a href="http://tools.ietf.org/html/rfc2616">Hypertext Transfer Protocol -- HTTP/1.1</a>”, RFC 2616, June 1999. |
|---|
| 1010 | </td> |
|---|
| 1011 | </tr> |
|---|
| 1012 | <tr> |
|---|
| 1013 | <td class="reference"><b id="RFC2617">[RFC2617]</b></td> |
|---|
| 1014 | <td class="top"><a href="mailto:john@math.nwu.edu" title="Northwestern University, Department of Mathematics">Franks, J.</a>, <a href="mailto:pbaker@verisign.com" title="Verisign Inc.">Hallam-Baker, P.</a>, <a href="mailto:jeff@AbiSource.com" title="AbiSource, Inc.">Hostetler, J.</a>, <a href="mailto:lawrence@agranat.com" title="Agranat Systems, Inc.">Lawrence, S.</a>, <a href="mailto:paulle@microsoft.com" title="Microsoft Corporation">Leach, P.</a>, Luotonen, A., and <a href="mailto:stewart@OpenMarket.com" title="Open Market, Inc.">L. Stewart</a>, “<a href="http://tools.ietf.org/html/rfc2617">HTTP Authentication: Basic and Digest Access Authentication</a>”, RFC 2617, June 1999. |
|---|
| 1015 | </td> |
|---|
| 1016 | </tr> |
|---|
| 1017 | <tr> |
|---|
| 1018 | <td class="reference"><b id="RFC3864">[RFC3864]</b></td> |
|---|
| 1019 | <td class="top"><a href="mailto:GK-IETF@ninebynine.org" title="Nine by Nine">Klyne, G.</a>, <a href="mailto:mnot@pobox.com" title="BEA Systems">Nottingham, M.</a>, and <a href="mailto:JeffMogul@acm.org" title="HP Labs">J. Mogul</a>, “<a href="http://tools.ietf.org/html/rfc3864">Registration Procedures for Message Header Fields</a>”, BCP 90, RFC 3864, September 2004. |
|---|
| 1020 | </td> |
|---|
| 1021 | </tr> |
|---|
| 1022 | <tr> |
|---|
| 1023 | <td class="reference"><b id="RFC3986">[RFC3986]</b></td> |
|---|
| 1024 | <td class="top"><a href="mailto:timbl@w3.org" title="World Wide Web Consortium">Berners-Lee, T.</a>, <a href="mailto:fielding@gbiv.com" title="Day Software">Fielding, R.</a>, and <a href="mailto:LMM@acm.org" title="Adobe Systems Incorporated">L. Masinter</a>, “<a href="http://tools.ietf.org/html/rfc3986">Uniform Resource Identifier (URI): Generic Syntax</a>”, STD 66, RFC 3986, January 2005. |
|---|
| 1025 | </td> |
|---|
| 1026 | </tr> |
|---|
| 1027 | <tr> |
|---|
| 1028 | <td class="reference"><b id="RFC4648">[RFC4648]</b></td> |
|---|
| 1029 | <td class="top">Josefsson, S., “<a href="http://tools.ietf.org/html/rfc4648">The Base16, Base32, and Base64 Data Encodings</a>”, RFC 4648, October 2006. |
|---|
| 1030 | </td> |
|---|
| 1031 | </tr> |
|---|
| 1032 | <tr> |
|---|
| 1033 | <td class="reference"><b id="RFC5226">[RFC5226]</b></td> |
|---|
| 1034 | <td class="top"><a href="mailto:narten@us.ibm.com" title="IBM">Narten, T.</a> and <a href="mailto:Harald@Alvestrand.no" title="Google">H. Alvestrand</a>, “<a href="http://tools.ietf.org/html/rfc5226">Guidelines for Writing an IANA Considerations Section in RFCs</a>”, BCP 26, RFC 5226, May 2008. |
|---|
| 1035 | </td> |
|---|
| 1036 | </tr> |
|---|
| 1037 | </table> |
|---|
| 1038 | <div class="avoidbreak"> |
|---|
| 1039 | <h1 id="rfc.authors"><a href="#rfc.authors">Authors' Addresses</a></h1> |
|---|
| 1040 | <address class="vcard"><span class="vcardline"><span class="fn">Roy T. Fielding</span> |
|---|
| 1041 | (editor) |
|---|
| 1042 | <span class="n hidden"><span class="family-name">Fielding</span><span class="given-name">Roy T.</span></span></span><span class="org vcardline">Adobe Systems Incorporated</span><span class="adr"><span class="street-address vcardline">345 Park Ave</span><span class="vcardline"><span class="locality">San Jose</span>, <span class="region">CA</span> <span class="postal-code">95110</span></span><span class="country-name vcardline">USA</span></span><span class="vcardline">Email: <a href="mailto:fielding@gbiv.com"><span class="email">fielding@gbiv.com</span></a></span><span class="vcardline">URI: <a href="http://roy.gbiv.com/" class="url">http://roy.gbiv.com/</a></span></address> |
|---|
| 1043 | <address class="vcard"><span class="vcardline"><span class="fn">Jim Gettys</span><span class="n hidden"><span class="family-name">Gettys</span><span class="given-name">Jim</span></span></span><span class="org vcardline">Alcatel-Lucent Bell Labs</span><span class="adr"><span class="street-address vcardline">21 Oak Knoll Road</span><span class="vcardline"><span class="locality">Carlisle</span>, <span class="region">MA</span> <span class="postal-code">01741</span></span><span class="country-name vcardline">USA</span></span><span class="vcardline">Email: <a href="mailto:jg@freedesktop.org"><span class="email">jg@freedesktop.org</span></a></span><span class="vcardline">URI: <a href="http://gettys.wordpress.com/" class="url">http://gettys.wordpress.com/</a></span></address> |
|---|
| 1044 | <address class="vcard"><span class="vcardline"><span class="fn">Jeffrey C. Mogul</span><span class="n hidden"><span class="family-name">Mogul</span><span class="given-name">Jeffrey C.</span></span></span><span class="org vcardline">Hewlett-Packard Company</span><span class="adr"><span class="street-address vcardline">HP Labs, Large Scale Systems Group</span><span class="street-address vcardline">1501 Page Mill Road, MS 1177</span><span class="vcardline"><span class="locality">Palo Alto</span>, <span class="region">CA</span> <span class="postal-code">94304</span></span><span class="country-name vcardline">USA</span></span><span class="vcardline">Email: <a href="mailto:JeffMogul@acm.org"><span class="email">JeffMogul@acm.org</span></a></span></address> |
|---|
| 1045 | <address class="vcard"><span class="vcardline"><span class="fn">Henrik Frystyk Nielsen</span><span class="n hidden"><span class="family-name">Frystyk</span></span></span><span class="org vcardline">Microsoft Corporation</span><span class="adr"><span class="street-address vcardline">1 Microsoft Way</span><span class="vcardline"><span class="locality">Redmond</span>, <span class="region">WA</span> <span class="postal-code">98052</span></span><span class="country-name vcardline">USA</span></span><span class="vcardline">Email: <a href="mailto:henrikn@microsoft.com"><span class="email">henrikn@microsoft.com</span></a></span></address> |
|---|
| 1046 | <address class="vcard"><span class="vcardline"><span class="fn">Larry Masinter</span><span class="n hidden"><span class="family-name">Masinter</span><span class="given-name">Larry</span></span></span><span class="org vcardline">Adobe Systems Incorporated</span><span class="adr"><span class="street-address vcardline">345 Park Ave</span><span class="vcardline"><span class="locality">San Jose</span>, <span class="region">CA</span> <span class="postal-code">95110</span></span><span class="country-name vcardline">USA</span></span><span class="vcardline">Email: <a href="mailto:LMM@acm.org"><span class="email">LMM@acm.org</span></a></span><span class="vcardline">URI: <a href="http://larry.masinter.net/" class="url">http://larry.masinter.net/</a></span></address> |
|---|
| 1047 | <address class="vcard"><span class="vcardline"><span class="fn">Paul J. Leach</span><span class="n hidden"><span class="family-name">Leach</span><span class="given-name">Paul J.</span></span></span><span class="org vcardline">Microsoft Corporation</span><span class="adr"><span class="street-address vcardline">1 Microsoft Way</span><span class="vcardline"><span class="locality">Redmond</span>, <span class="region">WA</span> <span class="postal-code">98052</span></span></span><span class="vcardline">Email: <a href="mailto:paulle@microsoft.com"><span class="email">paulle@microsoft.com</span></a></span></address> |
|---|
| 1048 | <address class="vcard"><span class="vcardline"><span class="fn">Tim Berners-Lee</span><span class="n hidden"><span class="family-name">Berners-Lee</span><span class="given-name">Tim</span></span></span><span class="org vcardline">World Wide Web Consortium</span><span class="adr"><span class="street-address vcardline">MIT Computer Science and Artificial Intelligence Laboratory</span><span class="street-address vcardline">The Stata Center, Building 32</span><span class="street-address vcardline">32 Vassar Street</span><span class="vcardline"><span class="locality">Cambridge</span>, <span class="region">MA</span> <span class="postal-code">02139</span></span><span class="country-name vcardline">USA</span></span><span class="vcardline">Email: <a href="mailto:timbl@w3.org"><span class="email">timbl@w3.org</span></a></span><span class="vcardline">URI: <a href="http://www.w3.org/People/Berners-Lee/" class="url">http://www.w3.org/People/Berners-Lee/</a></span></address> |
|---|
| 1049 | <address class="vcard"><span class="vcardline"><span class="fn">Yves Lafon</span> |
|---|
| 1050 | (editor) |
|---|
| 1051 | <span class="n hidden"><span class="family-name">Lafon</span><span class="given-name">Yves</span></span></span><span class="org vcardline">World Wide Web Consortium</span><span class="adr"><span class="street-address vcardline">W3C / ERCIM</span><span class="street-address vcardline">2004, rte des Lucioles</span><span class="vcardline"><span class="locality">Sophia-Antipolis</span>, <span class="region">AM</span> <span class="postal-code">06902</span></span><span class="country-name vcardline">France</span></span><span class="vcardline">Email: <a href="mailto:ylafon@w3.org"><span class="email">ylafon@w3.org</span></a></span><span class="vcardline">URI: <a href="http://www.raubacapeu.net/people/yves/" class="url">http://www.raubacapeu.net/people/yves/</a></span></address> |
|---|
| 1052 | <address class="vcard"><span class="vcardline"><span class="fn">Julian F. Reschke</span> |
|---|
| 1053 | (editor) |
|---|
| 1054 | <span class="n hidden"><span class="family-name">Reschke</span><span class="given-name">Julian F.</span></span></span><span class="org vcardline">greenbytes GmbH</span><span class="adr"><span class="street-address vcardline">Hafenweg 16</span><span class="vcardline"><span class="locality">Muenster</span>, <span class="region">NW</span> <span class="postal-code">48155</span></span><span class="country-name vcardline">Germany</span></span><span class="vcardline tel">Phone: <a href="tel:+492512807760"><span class="value">+49 251 2807760</span></a></span><span class="vcardline tel"><span class="type">Fax</span>: <a href="fax:+492512807761"><span class="value">+49 251 2807761</span></a></span><span class="vcardline">Email: <a href="mailto:julian.reschke@greenbytes.de"><span class="email">julian.reschke@greenbytes.de</span></a></span><span class="vcardline">URI: <a href="http://greenbytes.de/tech/webdav/" class="url">http://greenbytes.de/tech/webdav/</a></span></address> |
|---|
| 1055 | </div> |
|---|
| 1056 | <h1 id="rfc.section.A" class="np"><a href="#rfc.section.A">A.</a> <a id="changes.from.rfc.2616" href="#changes.from.rfc.2616">Changes from RFCs 2616 and 2617</a></h1> |
|---|
| 1057 | <p id="rfc.section.A.p.1">The "realm" parameter isn't required anymore in general; consequently, the ABNF allows challenges without any auth parameters. |
|---|
| 1058 | (<a href="#access.authentication.framework" title="Access Authentication Framework">Section 2</a>) |
|---|
| 1059 | </p> |
|---|
| 1060 | <p id="rfc.section.A.p.2">The "b64token" alternative to auth-param lists has been added for consistency with legacy authentication schemes such as "Basic". |
|---|
| 1061 | (<a href="#access.authentication.framework" title="Access Authentication Framework">Section 2</a>) |
|---|
| 1062 | </p> |
|---|
| 1063 | <p id="rfc.section.A.p.3">Change ABNF productions for header fields to only define the field value. (<a href="#header.field.definitions" title="Header Field Definitions">Section 4</a>) |
|---|
| 1064 | </p> |
|---|
| 1065 | <h1 id="rfc.section.B"><a href="#rfc.section.B">B.</a> <a id="collected.abnf" href="#collected.abnf">Collected ABNF</a></h1> |
|---|
| 1066 | <div id="rfc.figure.u.10"></div> <pre class="inline"><a href="#header.authorization" class="smpl">Authorization</a> = credentials |
|---|
| 1067 | |
|---|
| 1068 | <a href="#core.rules" class="smpl">BWS</a> = <BWS, defined in [Part1], Section 1.2.2> |
|---|
| 1069 | |
|---|
| 1070 | <a href="#core.rules" class="smpl">OWS</a> = <OWS, defined in [Part1], Section 1.2.2> |
|---|
| 1071 | |
|---|
| 1072 | <a href="#header.proxy-authenticate" class="smpl">Proxy-Authenticate</a> = *( "," OWS ) challenge *( OWS "," [ OWS |
|---|
| 1073 | challenge ] ) |
|---|
| 1074 | <a href="#header.proxy-authorization" class="smpl">Proxy-Authorization</a> = credentials |
|---|
| 1075 | |
|---|
| 1076 | <a href="#header.www-authenticate" class="smpl">WWW-Authenticate</a> = *( "," OWS ) challenge *( OWS "," [ OWS challenge |
|---|
| 1077 | ] ) |
|---|
| 1078 | |
|---|
| 1079 | <a href="#challenge.and.response" class="smpl">auth-param</a> = token BWS "=" BWS ( token / quoted-string ) |
|---|
| 1080 | <a href="#challenge.and.response" class="smpl">auth-scheme</a> = token |
|---|
| 1081 | |
|---|
| 1082 | <a href="#challenge.and.response" class="smpl">b64token</a> = 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) |
|---|
| 1083 | *"=" |
|---|
| 1084 | |
|---|
| 1085 | <a href="#challenge.and.response" class="smpl">challenge</a> = auth-scheme [ 1*SP ( b64token / [ ( "," / auth-param ) *( |
|---|
| 1086 | OWS "," [ OWS auth-param ] ) ] ) ] |
|---|
| 1087 | <a href="#challenge.and.response" class="smpl">credentials</a> = auth-scheme [ 1*SP ( b64token / [ ( "," / auth-param ) |
|---|
| 1088 | *( OWS "," [ OWS auth-param ] ) ] ) ] |
|---|
| 1089 | |
|---|
| 1090 | <a href="#core.rules" class="smpl">quoted-string</a> = <quoted-string, defined in [Part1], Section 3.2.3> |
|---|
| 1091 | |
|---|
| 1092 | <a href="#core.rules" class="smpl">token</a> = <token, defined in [Part1], Section 3.2.3> |
|---|
| 1093 | </pre> <div id="rfc.figure.u.11"></div> |
|---|
| 1094 | <p>ABNF diagnostics:</p><pre class="inline">; Authorization defined but not used |
|---|
| 1095 | ; Proxy-Authenticate defined but not used |
|---|
| 1096 | ; Proxy-Authorization defined but not used |
|---|
| 1097 | ; WWW-Authenticate defined but not used |
|---|
| 1098 | </pre><h1 id="rfc.section.C"><a href="#rfc.section.C">C.</a> <a id="change.log" href="#change.log">Change Log (to be removed by RFC Editor before publication)</a></h1> |
|---|
| 1099 | <h2 id="rfc.section.C.1"><a href="#rfc.section.C.1">C.1</a> Since RFC 2616 |
|---|
| 1100 | </h2> |
|---|
| 1101 | <p id="rfc.section.C.1.p.1">Extracted relevant partitions from <a href="#RFC2616" id="rfc.xref.RFC2616.2"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>. |
|---|
| 1102 | </p> |
|---|
| 1103 | <h2 id="rfc.section.C.2"><a href="#rfc.section.C.2">C.2</a> Since draft-ietf-httpbis-p7-auth-00 |
|---|
| 1104 | </h2> |
|---|
| 1105 | <p id="rfc.section.C.2.p.1">Closed issues: </p> |
|---|
| 1106 | <ul> |
|---|
| 1107 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/35">http://tools.ietf.org/wg/httpbis/trac/ticket/35</a>>: "Normative and Informative references" |
|---|
| 1108 | </li> |
|---|
| 1109 | </ul> |
|---|
| 1110 | <h2 id="rfc.section.C.3"><a href="#rfc.section.C.3">C.3</a> Since draft-ietf-httpbis-p7-auth-01 |
|---|
| 1111 | </h2> |
|---|
| 1112 | <p id="rfc.section.C.3.p.1">Ongoing work on ABNF conversion (<<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/36">http://tools.ietf.org/wg/httpbis/trac/ticket/36</a>>): |
|---|
| 1113 | </p> |
|---|
| 1114 | <ul> |
|---|
| 1115 | <li>Explicitly import BNF rules for "challenge" and "credentials" from RFC2617.</li> |
|---|
| 1116 | <li>Add explicit references to BNF syntax and rules imported from other parts of the specification.</li> |
|---|
| 1117 | </ul> |
|---|
| 1118 | <h2 id="rfc.section.C.4"><a href="#rfc.section.C.4">C.4</a> <a id="changes.since.02" href="#changes.since.02">Since draft-ietf-httpbis-p7-auth-02</a></h2> |
|---|
| 1119 | <p id="rfc.section.C.4.p.1">Ongoing work on IANA Message Header Field Registration (<<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/40">http://tools.ietf.org/wg/httpbis/trac/ticket/40</a>>): |
|---|
| 1120 | </p> |
|---|
| 1121 | <ul> |
|---|
| 1122 | <li>Reference RFC 3984, and update header field registrations for header fields defined in this document.</li> |
|---|
| 1123 | </ul> |
|---|
| 1124 | <h2 id="rfc.section.C.5"><a href="#rfc.section.C.5">C.5</a> <a id="changes.since.03" href="#changes.since.03">Since draft-ietf-httpbis-p7-auth-03</a></h2> |
|---|
| 1125 | <p id="rfc.section.C.5.p.1">None.</p> |
|---|
| 1126 | <h2 id="rfc.section.C.6"><a href="#rfc.section.C.6">C.6</a> <a id="changes.since.04" href="#changes.since.04">Since draft-ietf-httpbis-p7-auth-04</a></h2> |
|---|
| 1127 | <p id="rfc.section.C.6.p.1">Ongoing work on ABNF conversion (<<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/36">http://tools.ietf.org/wg/httpbis/trac/ticket/36</a>>): |
|---|
| 1128 | </p> |
|---|
| 1129 | <ul> |
|---|
| 1130 | <li>Use "/" instead of "|" for alternatives.</li> |
|---|
| 1131 | <li>Introduce new ABNF rules for "bad" whitespace ("BWS"), optional whitespace ("OWS") and required whitespace ("RWS").</li> |
|---|
| 1132 | <li>Rewrite ABNFs to spell out whitespace rules, factor out header field value format definitions.</li> |
|---|
| 1133 | </ul> |
|---|
| 1134 | <h2 id="rfc.section.C.7"><a href="#rfc.section.C.7">C.7</a> <a id="changes.since.05" href="#changes.since.05">Since draft-ietf-httpbis-p7-auth-05</a></h2> |
|---|
| 1135 | <p id="rfc.section.C.7.p.1">Final work on ABNF conversion (<<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/36">http://tools.ietf.org/wg/httpbis/trac/ticket/36</a>>): |
|---|
| 1136 | </p> |
|---|
| 1137 | <ul> |
|---|
| 1138 | <li>Add appendix containing collected and expanded ABNF, reorganize ABNF introduction.</li> |
|---|
| 1139 | </ul> |
|---|
| 1140 | <h2 id="rfc.section.C.8"><a href="#rfc.section.C.8">C.8</a> <a id="changes.since.06" href="#changes.since.06">Since draft-ietf-httpbis-p7-auth-06</a></h2> |
|---|
| 1141 | <p id="rfc.section.C.8.p.1">None.</p> |
|---|
| 1142 | <h2 id="rfc.section.C.9"><a href="#rfc.section.C.9">C.9</a> <a id="changes.since.07" href="#changes.since.07">Since draft-ietf-httpbis-p7-auth-07</a></h2> |
|---|
| 1143 | <p id="rfc.section.C.9.p.1">Closed issues: </p> |
|---|
| 1144 | <ul> |
|---|
| 1145 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/198">http://tools.ietf.org/wg/httpbis/trac/ticket/198</a>>: "move IANA registrations for optional status codes" |
|---|
| 1146 | </li> |
|---|
| 1147 | </ul> |
|---|
| 1148 | <h2 id="rfc.section.C.10"><a href="#rfc.section.C.10">C.10</a> <a id="changes.since.08" href="#changes.since.08">Since draft-ietf-httpbis-p7-auth-08</a></h2> |
|---|
| 1149 | <p id="rfc.section.C.10.p.1">No significant changes.</p> |
|---|
| 1150 | <h2 id="rfc.section.C.11"><a href="#rfc.section.C.11">C.11</a> <a id="changes.since.09" href="#changes.since.09">Since draft-ietf-httpbis-p7-auth-09</a></h2> |
|---|
| 1151 | <p id="rfc.section.C.11.p.1">Partly resolved issues: </p> |
|---|
| 1152 | <ul> |
|---|
| 1153 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/196">http://tools.ietf.org/wg/httpbis/trac/ticket/196</a>>: "Term for the requested resource's URI" |
|---|
| 1154 | </li> |
|---|
| 1155 | </ul> |
|---|
| 1156 | <h2 id="rfc.section.C.12"><a href="#rfc.section.C.12">C.12</a> <a id="changes.since.10" href="#changes.since.10">Since draft-ietf-httpbis-p7-auth-10</a></h2> |
|---|
| 1157 | <p id="rfc.section.C.12.p.1">None.</p> |
|---|
| 1158 | <h2 id="rfc.section.C.13"><a href="#rfc.section.C.13">C.13</a> <a id="changes.since.11" href="#changes.since.11">Since draft-ietf-httpbis-p7-auth-11</a></h2> |
|---|
| 1159 | <p id="rfc.section.C.13.p.1">Closed issues: </p> |
|---|
| 1160 | <ul> |
|---|
| 1161 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/130">http://tools.ietf.org/wg/httpbis/trac/ticket/130</a>>: "introduction to part 7 is work-in-progress" |
|---|
| 1162 | </li> |
|---|
| 1163 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/195">http://tools.ietf.org/wg/httpbis/trac/ticket/195</a>>: "auth-param syntax" |
|---|
| 1164 | </li> |
|---|
| 1165 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/224">http://tools.ietf.org/wg/httpbis/trac/ticket/224</a>>: "Header Classification" |
|---|
| 1166 | </li> |
|---|
| 1167 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/237">http://tools.ietf.org/wg/httpbis/trac/ticket/237</a>>: "absorbing the auth framework from 2617" |
|---|
| 1168 | </li> |
|---|
| 1169 | </ul> |
|---|
| 1170 | <p id="rfc.section.C.13.p.2">Partly resolved issues: </p> |
|---|
| 1171 | <ul> |
|---|
| 1172 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/141">http://tools.ietf.org/wg/httpbis/trac/ticket/141</a>>: "should we have an auth scheme registry" |
|---|
| 1173 | </li> |
|---|
| 1174 | </ul> |
|---|
| 1175 | <h2 id="rfc.section.C.14"><a href="#rfc.section.C.14">C.14</a> <a id="changes.since.12" href="#changes.since.12">Since draft-ietf-httpbis-p7-auth-12</a></h2> |
|---|
| 1176 | <p id="rfc.section.C.14.p.1">None.</p> |
|---|
| 1177 | <h2 id="rfc.section.C.15"><a href="#rfc.section.C.15">C.15</a> <a id="changes.since.13" href="#changes.since.13">Since draft-ietf-httpbis-p7-auth-13</a></h2> |
|---|
| 1178 | <p id="rfc.section.C.15.p.1">Closed issues: </p> |
|---|
| 1179 | <ul> |
|---|
| 1180 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/276">http://tools.ietf.org/wg/httpbis/trac/ticket/276</a>>: "untangle ABNFs for header fields" |
|---|
| 1181 | </li> |
|---|
| 1182 | </ul> |
|---|
| 1183 | <h2 id="rfc.section.C.16"><a href="#rfc.section.C.16">C.16</a> <a id="changes.since.14" href="#changes.since.14">Since draft-ietf-httpbis-p7-auth-14</a></h2> |
|---|
| 1184 | <p id="rfc.section.C.16.p.1">None.</p> |
|---|
| 1185 | <h2 id="rfc.section.C.17"><a href="#rfc.section.C.17">C.17</a> <a id="changes.since.15" href="#changes.since.15">Since draft-ietf-httpbis-p7-auth-15</a></h2> |
|---|
| 1186 | <p id="rfc.section.C.17.p.1">Closed issues: </p> |
|---|
| 1187 | <ul> |
|---|
| 1188 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/78">http://tools.ietf.org/wg/httpbis/trac/ticket/78</a>>: "Relationship between 401, Authorization and WWW-Authenticate" |
|---|
| 1189 | </li> |
|---|
| 1190 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/177">http://tools.ietf.org/wg/httpbis/trac/ticket/177</a>>: "Realm required on challenges" |
|---|
| 1191 | </li> |
|---|
| 1192 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/195">http://tools.ietf.org/wg/httpbis/trac/ticket/195</a>>: "auth-param syntax" |
|---|
| 1193 | </li> |
|---|
| 1194 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/257">http://tools.ietf.org/wg/httpbis/trac/ticket/257</a>>: "Considerations for new authentications schemes" |
|---|
| 1195 | </li> |
|---|
| 1196 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/287">http://tools.ietf.org/wg/httpbis/trac/ticket/287</a>>: "LWS in auth-param ABNF" |
|---|
| 1197 | </li> |
|---|
| 1198 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/309">http://tools.ietf.org/wg/httpbis/trac/ticket/309</a>>: "credentials ABNF missing SP (still using implied LWS?)" |
|---|
| 1199 | </li> |
|---|
| 1200 | </ul> |
|---|
| 1201 | <h2 id="rfc.section.C.18"><a href="#rfc.section.C.18">C.18</a> <a id="changes.since.16" href="#changes.since.16">Since draft-ietf-httpbis-p7-auth-16</a></h2> |
|---|
| 1202 | <p id="rfc.section.C.18.p.1">Closed issues: </p> |
|---|
| 1203 | <ul> |
|---|
| 1204 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/186">http://tools.ietf.org/wg/httpbis/trac/ticket/186</a>>: "Document HTTP's error-handling philosophy" |
|---|
| 1205 | </li> |
|---|
| 1206 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/320">http://tools.ietf.org/wg/httpbis/trac/ticket/320</a>>: "add advice on defining auth scheme parameters" |
|---|
| 1207 | </li> |
|---|
| 1208 | </ul> |
|---|
| 1209 | <h2 id="rfc.section.C.19"><a href="#rfc.section.C.19">C.19</a> <a id="changes.since.17" href="#changes.since.17">Since draft-ietf-httpbis-p7-auth-17</a></h2> |
|---|
| 1210 | <p id="rfc.section.C.19.p.1">Closed issues: </p> |
|---|
| 1211 | <ul> |
|---|
| 1212 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/314">http://tools.ietf.org/wg/httpbis/trac/ticket/314</a>>: "allow unquoted realm parameters" |
|---|
| 1213 | </li> |
|---|
| 1214 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/321">http://tools.ietf.org/wg/httpbis/trac/ticket/321</a>>: "Repeating auth-params" |
|---|
| 1215 | </li> |
|---|
| 1216 | </ul> |
|---|
| 1217 | <h2 id="rfc.section.C.20"><a href="#rfc.section.C.20">C.20</a> <a id="changes.since.18" href="#changes.since.18">Since draft-ietf-httpbis-p7-auth-18</a></h2> |
|---|
| 1218 | <p id="rfc.section.C.20.p.1">None yet.</p> |
|---|
| 1219 | <h1 id="rfc.index"><a href="#rfc.index">Index</a></h1> |
|---|
| 1220 | <p class="noprint"><a href="#rfc.index.4">4</a> <a href="#rfc.index.A">A</a> <a href="#rfc.index.B">B</a> <a href="#rfc.index.C">C</a> <a href="#rfc.index.G">G</a> <a href="#rfc.index.H">H</a> <a href="#rfc.index.P">P</a> <a href="#rfc.index.R">R</a> <a href="#rfc.index.S">S</a> <a href="#rfc.index.W">W</a> |
|---|
| 1221 | </p> |
|---|
| 1222 | <div class="print2col"> |
|---|
| 1223 | <ul class="ind"> |
|---|
| 1224 | <li><a id="rfc.index.4" href="#rfc.index.4"><b>4</b></a><ul> |
|---|
| 1225 | <li>401 Unauthorized (status code) <a href="#rfc.iref.12"><b>3.1</b></a>, <a href="#rfc.xref.status.401.1">5.2</a></li> |
|---|
| 1226 | <li>407 Proxy Authentication Required (status code) <a href="#rfc.iref.13"><b>3.2</b></a>, <a href="#rfc.xref.status.407.1">5.2</a></li> |
|---|
| 1227 | </ul> |
|---|
| 1228 | </li> |
|---|
| 1229 | <li><a id="rfc.index.A" href="#rfc.index.A"><b>A</b></a><ul> |
|---|
| 1230 | <li><tt>auth-param</tt> <a href="#rfc.iref.a.2"><b>2.1</b></a></li> |
|---|
| 1231 | <li><tt>auth-scheme</tt> <a href="#rfc.iref.a.1"><b>2.1</b></a></li> |
|---|
| 1232 | <li>Authorization header field <a href="#rfc.xref.header.authorization.1">2.1</a>, <a href="#rfc.xref.header.authorization.2">3.1</a>, <a href="#rfc.iref.a.3"><b>4.1</b></a>, <a href="#rfc.xref.header.authorization.3">5.3</a></li> |
|---|
| 1233 | </ul> |
|---|
| 1234 | </li> |
|---|
| 1235 | <li><a id="rfc.index.B" href="#rfc.index.B"><b>B</b></a><ul> |
|---|
| 1236 | <li><tt>b64token</tt> <a href="#rfc.iref.b.1"><b>2.1</b></a></li> |
|---|
| 1237 | </ul> |
|---|
| 1238 | </li> |
|---|
| 1239 | <li><a id="rfc.index.C" href="#rfc.index.C"><b>C</b></a><ul> |
|---|
| 1240 | <li><tt>challenge</tt> <a href="#rfc.iref.c.1"><b>2.1</b></a></li> |
|---|
| 1241 | <li><tt>credentials</tt> <a href="#rfc.iref.c.2"><b>2.1</b></a></li> |
|---|
| 1242 | </ul> |
|---|
| 1243 | </li> |
|---|
| 1244 | <li><a id="rfc.index.G" href="#rfc.index.G"><b>G</b></a><ul> |
|---|
| 1245 | <li><tt>Grammar</tt> |
|---|
| 1246 | <ul> |
|---|
| 1247 | <li><tt>auth-param</tt> <a href="#rfc.iref.g.2"><b>2.1</b></a></li> |
|---|
| 1248 | <li><tt>auth-scheme</tt> <a href="#rfc.iref.g.1"><b>2.1</b></a></li> |
|---|
| 1249 | <li><tt>Authorization</tt> <a href="#rfc.iref.g.6"><b>4.1</b></a></li> |
|---|
| 1250 | <li><tt>b64token</tt> <a href="#rfc.iref.g.3"><b>2.1</b></a></li> |
|---|
| 1251 | <li><tt>challenge</tt> <a href="#rfc.iref.g.4"><b>2.1</b></a></li> |
|---|
| 1252 | <li><tt>credentials</tt> <a href="#rfc.iref.g.5"><b>2.1</b></a></li> |
|---|
| 1253 | <li><tt>Proxy-Authenticate</tt> <a href="#rfc.iref.g.7"><b>4.2</b></a></li> |
|---|
| 1254 | <li><tt>Proxy-Authorization</tt> <a href="#rfc.iref.g.8"><b>4.3</b></a></li> |
|---|
| 1255 | <li><tt>WWW-Authenticate</tt> <a href="#rfc.iref.g.9"><b>4.4</b></a></li> |
|---|
| 1256 | </ul> |
|---|
| 1257 | </li> |
|---|
| 1258 | </ul> |
|---|
| 1259 | </li> |
|---|
| 1260 | <li><a id="rfc.index.H" href="#rfc.index.H"><b>H</b></a><ul> |
|---|
| 1261 | <li>Header Fields |
|---|
| 1262 | <ul> |
|---|
| 1263 | <li>Authorization <a href="#rfc.xref.header.authorization.1">2.1</a>, <a href="#rfc.xref.header.authorization.2">3.1</a>, <a href="#rfc.iref.h.1"><b>4.1</b></a>, <a href="#rfc.xref.header.authorization.3">5.3</a></li> |
|---|
| 1264 | <li>Proxy-Authenticate <a href="#rfc.xref.header.proxy-authenticate.1">3.2</a>, <a href="#rfc.iref.h.2"><b>4.2</b></a>, <a href="#rfc.xref.header.proxy-authenticate.2">5.3</a></li> |
|---|
| 1265 | <li>Proxy-Authorization <a href="#rfc.xref.header.proxy-authorization.1">3.2</a>, <a href="#rfc.iref.h.3"><b>4.3</b></a>, <a href="#rfc.xref.header.proxy-authorization.2">5.3</a></li> |
|---|
| 1266 | <li>WWW-Authenticate <a href="#rfc.xref.header.www-authenticate.1">3.1</a>, <a href="#rfc.iref.h.4"><b>4.4</b></a>, <a href="#rfc.xref.header.www-authenticate.2">5.3</a></li> |
|---|
| 1267 | </ul> |
|---|
| 1268 | </li> |
|---|
| 1269 | </ul> |
|---|
| 1270 | </li> |
|---|
| 1271 | <li><a id="rfc.index.P" href="#rfc.index.P"><b>P</b></a><ul> |
|---|
| 1272 | <li><em>Part1</em> <a href="#rfc.xref.Part1.1">1.1</a>, <a href="#rfc.xref.Part1.2">1.2</a>, <a href="#rfc.xref.Part1.3">1.2.1</a>, <a href="#rfc.xref.Part1.4">1.2.1</a>, <a href="#rfc.xref.Part1.5">1.2.1</a>, <a href="#rfc.xref.Part1.6">1.2.1</a>, <a href="#rfc.xref.Part1.7">1.2.1</a>, <a href="#rfc.xref.Part1.8">2.2</a>, <a href="#rfc.xref.Part1.9">2.3.1</a>, <a href="#rfc.xref.Part1.10">4.2</a>, <a href="#rfc.xref.Part1.11">4.4</a>, <a href="#rfc.xref.Part1.12">7</a>, <a href="#Part1"><b>8.1</b></a><ul> |
|---|
| 1273 | <li><em>Section 1.2</em> <a href="#rfc.xref.Part1.2">1.2</a></li> |
|---|
| 1274 | <li><em>Section 1.2.2</em> <a href="#rfc.xref.Part1.4">1.2.1</a>, <a href="#rfc.xref.Part1.5">1.2.1</a></li> |
|---|
| 1275 | <li><em>Section 2</em> <a href="#rfc.xref.Part1.1">1.1</a></li> |
|---|
| 1276 | <li><em>Section 2.2</em> <a href="#rfc.xref.Part1.9">2.3.1</a></li> |
|---|
| 1277 | <li><em>Section 3.2.3</em> <a href="#rfc.xref.Part1.6">1.2.1</a>, <a href="#rfc.xref.Part1.7">1.2.1</a></li> |
|---|
| 1278 | <li><em>Section 4.3</em> <a href="#rfc.xref.Part1.8">2.2</a>, <a href="#rfc.xref.Part1.10">4.2</a>, <a href="#rfc.xref.Part1.11">4.4</a></li> |
|---|
| 1279 | <li><em>Section 11</em> <a href="#rfc.xref.Part1.12">7</a></li> |
|---|
| 1280 | </ul> |
|---|
| 1281 | </li> |
|---|
| 1282 | <li><em>Part6</em> <a href="#rfc.xref.Part6.1">4.1</a>, <a href="#Part6"><b>8.1</b></a><ul> |
|---|
| 1283 | <li><em>Section 1.2</em> <a href="#rfc.xref.Part6.1">4.1</a></li> |
|---|
| 1284 | </ul> |
|---|
| 1285 | </li> |
|---|
| 1286 | <li>Protection Space <a href="#rfc.iref.p.1">2.2</a></li> |
|---|
| 1287 | <li>Proxy-Authenticate header field <a href="#rfc.xref.header.proxy-authenticate.1">3.2</a>, <a href="#rfc.iref.p.2"><b>4.2</b></a>, <a href="#rfc.xref.header.proxy-authenticate.2">5.3</a></li> |
|---|
| 1288 | <li>Proxy-Authorization header field <a href="#rfc.xref.header.proxy-authorization.1">3.2</a>, <a href="#rfc.iref.p.3"><b>4.3</b></a>, <a href="#rfc.xref.header.proxy-authorization.2">5.3</a></li> |
|---|
| 1289 | </ul> |
|---|
| 1290 | </li> |
|---|
| 1291 | <li><a id="rfc.index.R" href="#rfc.index.R"><b>R</b></a><ul> |
|---|
| 1292 | <li>Realm <a href="#rfc.iref.r.1">2.2</a></li> |
|---|
| 1293 | <li><em>RFC2119</em> <a href="#rfc.xref.RFC2119.1">1.1</a>, <a href="#RFC2119"><b>8.1</b></a></li> |
|---|
| 1294 | <li><em>RFC2616</em> <a href="#rfc.xref.RFC2616.1">1</a>, <a href="#RFC2616"><b>8.2</b></a>, <a href="#rfc.xref.RFC2616.2">C.1</a></li> |
|---|
| 1295 | <li><em>RFC2617</em> <a href="#rfc.xref.RFC2617.1">1</a>, <a href="#rfc.xref.RFC2617.2">1</a>, <a href="#rfc.xref.RFC2617.3">7</a>, <a href="#rfc.xref.RFC2617.4">7</a>, <a href="#RFC2617"><b>8.2</b></a><ul> |
|---|
| 1296 | <li><em>Section 6</em> <a href="#rfc.xref.RFC2617.4">7</a></li> |
|---|
| 1297 | </ul> |
|---|
| 1298 | </li> |
|---|
| 1299 | <li><em>RFC3864</em> <a href="#rfc.xref.RFC3864.1">5.3</a>, <a href="#RFC3864"><b>8.2</b></a></li> |
|---|
| 1300 | <li><em>RFC3986</em> <a href="#rfc.xref.RFC3986.1">2.1</a>, <a href="#RFC3986"><b>8.2</b></a></li> |
|---|
| 1301 | <li><em>RFC4648</em> <a href="#rfc.xref.RFC4648.1">2.1</a>, <a href="#RFC4648"><b>8.2</b></a></li> |
|---|
| 1302 | <li><em>RFC5226</em> <a href="#rfc.xref.RFC5226.1">2.3</a>, <a href="#RFC5226"><b>8.2</b></a><ul> |
|---|
| 1303 | <li><em>Section 4.1</em> <a href="#rfc.xref.RFC5226.1">2.3</a></li> |
|---|
| 1304 | </ul> |
|---|
| 1305 | </li> |
|---|
| 1306 | <li><em>RFC5234</em> <a href="#rfc.xref.RFC5234.1">1.2</a>, <a href="#rfc.xref.RFC5234.2">1.2</a>, <a href="#RFC5234"><b>8.1</b></a><ul> |
|---|
| 1307 | <li><em>Appendix B.1</em> <a href="#rfc.xref.RFC5234.2">1.2</a></li> |
|---|
| 1308 | </ul> |
|---|
| 1309 | </li> |
|---|
| 1310 | </ul> |
|---|
| 1311 | </li> |
|---|
| 1312 | <li><a id="rfc.index.S" href="#rfc.index.S"><b>S</b></a><ul> |
|---|
| 1313 | <li>Status Codes |
|---|
| 1314 | <ul> |
|---|
| 1315 | <li>401 Unauthorized <a href="#rfc.iref.s.1"><b>3.1</b></a>, <a href="#rfc.xref.status.401.1">5.2</a></li> |
|---|
| 1316 | <li>407 Proxy Authentication Required <a href="#rfc.iref.s.2"><b>3.2</b></a>, <a href="#rfc.xref.status.407.1">5.2</a></li> |
|---|
| 1317 | </ul> |
|---|
| 1318 | </li> |
|---|
| 1319 | </ul> |
|---|
| 1320 | </li> |
|---|
| 1321 | <li><a id="rfc.index.W" href="#rfc.index.W"><b>W</b></a><ul> |
|---|
| 1322 | <li>WWW-Authenticate header field <a href="#rfc.xref.header.www-authenticate.1">3.1</a>, <a href="#rfc.iref.w.1"><b>4.4</b></a>, <a href="#rfc.xref.header.www-authenticate.2">5.3</a></li> |
|---|
| 1323 | </ul> |
|---|
| 1324 | </li> |
|---|
| 1325 | </ul> |
|---|
| 1326 | </div> |
|---|
| 1327 | </body> |
|---|
| 1328 | </html> |
|---|
![(please configure the [header_logo] section in trac.ini)](https://www.ietf.org/images/ietflogotrans.gif)
