Changeset 1387 for draft-ietf-httpbis/latest/p7-auth.html
- Timestamp:
- 08/08/11 12:54:36 (12 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
draft-ietf-httpbis/latest/p7-auth.html
r1386 r1387 641 641 via that scheme. 642 642 </p> 643 <div id="rfc.figure.u.2"></div><pre class="inline"><span id="rfc.iref.a.1"></span><span id="rfc.iref.a.2"></span> auth-scheme = <a href="#core.rules" class="smpl">token</a>643 <div id="rfc.figure.u.2"></div><pre class="inline"><span id="rfc.iref.a.1"></span><span id="rfc.iref.a.2"></span><span id="rfc.iref.g.1"></span><span id="rfc.iref.g.2"></span> auth-scheme = <a href="#core.rules" class="smpl">token</a> 644 644 auth-param = <a href="#core.rules" class="smpl">token</a> <a href="#core.rules" class="smpl">BWS</a> "=" <a href="#core.rules" class="smpl">BWS</a> ( <a href="#core.rules" class="smpl">token</a> / <a href="#core.rules" class="smpl">quoted-string</a> ) 645 645 </pre><p id="rfc.section.2.1.p.3">The 401 (Unauthorized) response message is used by an origin server to challenge the authorization of a user agent. This response <em class="bcp14">MUST</em> include a WWW-Authenticate header field containing at least one challenge applicable to the requested resource. … … 647 647 <p id="rfc.section.2.1.p.4">The 407 (Proxy Authentication Required) response message is used by a proxy to challenge the authorization of a client and <em class="bcp14">MUST</em> include a Proxy-Authenticate header field containing at least one challenge applicable to the proxy for the requested resource. 648 648 </p> 649 <div id="rfc.figure.u.3"></div><pre class="inline"><span id="rfc.iref.c.1"></span> <a href="#challenge.and.response" class="smpl">challenge</a> = <a href="#challenge.and.response" class="smpl">auth-scheme</a> 1*<a href="#notation" class="smpl">SP</a> #<a href="#challenge.and.response" class="smpl">auth-param</a>649 <div id="rfc.figure.u.3"></div><pre class="inline"><span id="rfc.iref.c.1"></span><span id="rfc.iref.g.3"></span> <a href="#challenge.and.response" class="smpl">challenge</a> = <a href="#challenge.and.response" class="smpl">auth-scheme</a> 1*<a href="#notation" class="smpl">SP</a> #<a href="#challenge.and.response" class="smpl">auth-param</a> 650 650 </pre><div class="note" id="rfc.section.2.1.p.6"> 651 651 <p> <b>Note:</b> User agents will need to take special care in parsing the WWW-Authenticate and Proxy-Authenticate header field values because … … 669 669 upon that challenge. 670 670 </p> 671 <div id="rfc.figure.u.4"></div><pre class="inline"><span id="rfc.iref.c.2"></span> <a href="#challenge.and.response" class="smpl">credentials</a> = <a href="#challenge.and.response" class="smpl">auth-scheme</a> 1*<a href="#notation" class="smpl">SP</a> ( <a href="#core.rules" class="smpl">token</a>671 <div id="rfc.figure.u.4"></div><pre class="inline"><span id="rfc.iref.c.2"></span><span id="rfc.iref.g.4"></span> <a href="#challenge.and.response" class="smpl">credentials</a> = <a href="#challenge.and.response" class="smpl">auth-scheme</a> 1*<a href="#notation" class="smpl">SP</a> ( <a href="#core.rules" class="smpl">token</a> 672 672 / <a href="#core.rules" class="smpl">quoted-string</a> 673 673 / #<a href="#challenge.and.response" class="smpl">auth-param</a> ) … … 687 687 <h2 id="rfc.section.2.2"><a href="#rfc.section.2.2">2.2</a> <a id="protection.space" href="#protection.space">Protection Space (Realm)</a></h2> 688 688 <p id="rfc.section.2.2.p.1">The authentication parameter realm is reserved for use by authentication schemes that wish to indicate the scope of protection:</p> 689 <div id="rfc.figure.u.5"></div><pre class="inline"><span id="rfc.iref.r.2"></span><span id="rfc.iref.r.3"></span> realm = "realm" "=" realm-value689 <div id="rfc.figure.u.5"></div><pre class="inline"><span id="rfc.iref.r.2"></span><span id="rfc.iref.r.3"></span><span id="rfc.iref.g.5"></span> realm = "realm" "=" realm-value 690 690 realm-value = quoted-string 691 691 </pre><p id="rfc.section.2.2.p.3">A <dfn>protection space</dfn> is defined by the canonical root URI (the scheme and authority components of the effective request URI; see <a href="p1-messaging.html#effective.request.uri" title="Effective Request URI">Section 4.3</a> of <a href="#Part1" id="rfc.xref.Part1.7"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>) of the server being accessed, in combination with the realm value if present. These realms allow the protected resources … … 744 744 </ul> 745 745 <h1 id="rfc.section.3"><a href="#rfc.section.3">3.</a> <a id="status.code.definitions" href="#status.code.definitions">Status Code Definitions</a></h1> 746 <div id="rfc.iref. 8"></div>746 <div id="rfc.iref.13"></div> 747 747 <div id="rfc.iref.s.1"></div> 748 748 <h2 id="rfc.section.3.1"><a href="#rfc.section.3.1">3.1</a> <a id="status.401" href="#status.401">401 Unauthorized</a></h2> … … 752 752 information. 753 753 </p> 754 <div id="rfc.iref. 9"></div>754 <div id="rfc.iref.14"></div> 755 755 <div id="rfc.iref.s.2"></div> 756 756 <h2 id="rfc.section.3.2"><a href="#rfc.section.3.2">3.2</a> <a id="status.407" href="#status.407">407 Proxy Authentication Required</a></h2> … … 767 767 for the realm of the resource being requested. 768 768 </p> 769 <div id="rfc.figure.u.6"></div><pre class="inline"><span id="rfc.iref.g. 1"></span> <a href="#header.authorization" class="smpl">Authorization</a> = <a href="#challenge.and.response" class="smpl">credentials</a>769 <div id="rfc.figure.u.6"></div><pre class="inline"><span id="rfc.iref.g.6"></span> <a href="#header.authorization" class="smpl">Authorization</a> = <a href="#challenge.and.response" class="smpl">credentials</a> 770 770 </pre><p id="rfc.section.4.1.p.3">If a request is authenticated and a realm specified, the same credentials <em class="bcp14">SHOULD</em> be valid for all other requests within this realm (assuming that the authentication scheme itself does not require otherwise, 771 771 such as credentials that vary according to a challenge value or using synchronized clocks). … … 790 790 to the proxy for this effective request URI (<a href="p1-messaging.html#effective.request.uri" title="Effective Request URI">Section 4.3</a> of <a href="#Part1" id="rfc.xref.Part1.9"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). It <em class="bcp14">MUST</em> be included as part of a 407 (Proxy Authentication Required) response. 791 791 </p> 792 <div id="rfc.figure.u.7"></div><pre class="inline"><span id="rfc.iref.g. 2"></span> <a href="#header.proxy-authenticate" class="smpl">Proxy-Authenticate</a> = 1#<a href="#challenge.and.response" class="smpl">challenge</a>792 <div id="rfc.figure.u.7"></div><pre class="inline"><span id="rfc.iref.g.7"></span> <a href="#header.proxy-authenticate" class="smpl">Proxy-Authenticate</a> = 1#<a href="#challenge.and.response" class="smpl">challenge</a> 793 793 </pre><p id="rfc.section.4.2.p.3">Unlike WWW-Authenticate, the Proxy-Authenticate header field applies only to the current connection and <em class="bcp14">SHOULD NOT</em> be passed on to downstream clients. However, an intermediate proxy might need to obtain its own credentials by requesting 794 794 them from the downstream client, which in some circumstances will appear as if the proxy is forwarding the Proxy-Authenticate … … 802 802 the resource being requested. 803 803 </p> 804 <div id="rfc.figure.u.8"></div><pre class="inline"><span id="rfc.iref.g. 3"></span> <a href="#header.proxy-authorization" class="smpl">Proxy-Authorization</a> = <a href="#challenge.and.response" class="smpl">credentials</a>804 <div id="rfc.figure.u.8"></div><pre class="inline"><span id="rfc.iref.g.8"></span> <a href="#header.proxy-authorization" class="smpl">Proxy-Authorization</a> = <a href="#challenge.and.response" class="smpl">credentials</a> 805 805 </pre><p id="rfc.section.4.3.p.3">Unlike Authorization, the Proxy-Authorization header field applies only to the next outbound proxy that demanded authentication 806 806 using the Proxy-Authenticate field. When multiple proxies are used in a chain, the Proxy-Authorization header field is consumed … … 817 817 response. 818 818 </p> 819 <div id="rfc.figure.u.9"></div><pre class="inline"><span id="rfc.iref.g. 4"></span> <a href="#header.www-authenticate" class="smpl">WWW-Authenticate</a> = 1#<a href="#challenge.and.response" class="smpl">challenge</a>819 <div id="rfc.figure.u.9"></div><pre class="inline"><span id="rfc.iref.g.9"></span> <a href="#header.www-authenticate" class="smpl">WWW-Authenticate</a> = 1#<a href="#challenge.and.response" class="smpl">challenge</a> 820 820 </pre><p id="rfc.section.4.4.p.4">User agents are advised to take special care in parsing the WWW-Authenticate field value as it might contain more than one 821 821 challenge, or if more than one WWW-Authenticate header field is provided, the contents of a challenge itself can contain a … … 1148 1148 <ul class="ind"> 1149 1149 <li><a id="rfc.index.4" href="#rfc.index.4"><b>4</b></a><ul> 1150 <li>401 Unauthorized (status code) <a href="#rfc.iref. 8"><b>3.1</b></a>, <a href="#rfc.xref.status.401.1">5.2</a></li>1151 <li>407 Proxy Authentication Required (status code) <a href="#rfc.iref. 9"><b>3.2</b></a>, <a href="#rfc.xref.status.407.1">5.2</a></li>1150 <li>401 Unauthorized (status code) <a href="#rfc.iref.13"><b>3.1</b></a>, <a href="#rfc.xref.status.401.1">5.2</a></li> 1151 <li>407 Proxy Authentication Required (status code) <a href="#rfc.iref.14"><b>3.2</b></a>, <a href="#rfc.xref.status.407.1">5.2</a></li> 1152 1152 </ul> 1153 1153 </li> … … 1166 1166 <li><tt>Grammar</tt> 1167 1167 <ul> 1168 <li><tt>Authorization</tt> <a href="#rfc.iref.g.1"><b>4.1</b></a></li> 1169 <li><tt>Proxy-Authenticate</tt> <a href="#rfc.iref.g.2"><b>4.2</b></a></li> 1170 <li><tt>Proxy-Authorization</tt> <a href="#rfc.iref.g.3"><b>4.3</b></a></li> 1171 <li><tt>WWW-Authenticate</tt> <a href="#rfc.iref.g.4"><b>4.4</b></a></li> 1168 <li><tt>auth-param</tt> <a href="#rfc.iref.g.2"><b>2.1</b></a></li> 1169 <li><tt>auth-scheme</tt> <a href="#rfc.iref.g.1"><b>2.1</b></a></li> 1170 <li><tt>Authorization</tt> <a href="#rfc.iref.g.6"><b>4.1</b></a></li> 1171 <li><tt>challenge</tt> <a href="#rfc.iref.g.3"><b>2.1</b></a></li> 1172 <li><tt>credentials</tt> <a href="#rfc.iref.g.4"><b>2.1</b></a></li> 1173 <li><tt>Proxy-Authenticate</tt> <a href="#rfc.iref.g.7"><b>4.2</b></a></li> 1174 <li><tt>Proxy-Authorization</tt> <a href="#rfc.iref.g.8"><b>4.3</b></a></li> 1175 <li><tt>realm</tt> <a href="#rfc.iref.g.5"><b>2.2</b></a></li> 1176 <li><tt>WWW-Authenticate</tt> <a href="#rfc.iref.g.9"><b>4.4</b></a></li> 1172 1177 </ul> 1173 1178 </li>
Note: See TracChangeset
for help on using the changeset viewer.