Changeset 2066 for draft-ietf-httpbis/latest/p7-auth.xml

Timestamp:

Dec 29, 2012, 2:14:11 AM (7 years ago)

Author:

fielding@…

Message:

(editorial) rephrasing to better target the subject of requirements

File:

• draft-ietf-httpbis/latest/p7-auth.xml (modified) (3 diffs)

draft-ietf-httpbis/latest/p7-auth.xml

@@ -242 +242 @@
    invalid credentials (e.g., a bad password) or partial credentials (e.g.,
    when the authentication scheme requires more than one round trip), an origin
-   server &SHOULD; send a <x:ref>401 (Unauthorized)</x:ref> response. Such
-   responses &MUST; include a <x:ref>WWW-Authenticate</x:ref> header field
-   containing at least one (possibly new) challenge applicable to the
-   requested resource.
+   server &SHOULD; send a <x:ref>401 (Unauthorized)</x:ref> response that
+   contains a <x:ref>WWW-Authenticate</x:ref> header field with at least one
+   (possibly new) challenge applicable to the requested resource.
 </t>
 <t>
    Likewise, upon a request that requires authentication by proxies that omit
    credentials or contain invalid or partial credentials, a proxy &SHOULD;
-   send a <x:ref>407 (Proxy Authentication Required)</x:ref> response. Such responses
-   &MUST; include a <x:ref>Proxy-Authenticate</x:ref> header field containing a (possibly
+   send a <x:ref>407 (Proxy Authentication Required)</x:ref> response that
+   contains a <x:ref>Proxy-Authenticate</x:ref> header field with a (possibly
    new) challenge applicable to the proxy.
 </t>
@@ -427 +426 @@
   <x:anchor-alias value="401 (Unauthorized)"/>
 <t>
-   The request requires user authentication. The response &MUST; include a
+   The <x:dfn>401 (Unauthorized)</x:dfn> status code indicates that the
+   request has not been applied because it lacks valid authentication
+   credentials for the target resource. The origin server &MUST; send a
    <x:ref>WWW-Authenticate</x:ref> header field (<xref target="header.www-authenticate"/>)
-   containing a challenge applicable to the target resource. The client &MAY;
-   repeat the request with a suitable <x:ref>Authorization</x:ref> header field
-   (<xref target="header.authorization"/>). If the request already included
-   Authorization credentials, then the 401 response indicates that authorization
-   has been refused for those credentials. If the 401 response contains the
-   same challenge as the prior response, and the user agent has already attempted
-   authentication at least once, then the user &SHOULD; be presented the
-   representation that was given in the response, since that representation might
-   include relevant diagnostic information.
+   containing at least one challenge applicable to the target resource.
+   If the request included authentication credentials, then the 401 response
+   indicates that authorization has been refused for those credentials.
+   The client &MAY; repeat the request with a new or replaced
+   <x:ref>Authorization</x:ref> header field (<xref target="header.authorization"/>).
+   If the 401 response contains the same challenge as the prior response, and
+   the user agent has already attempted authentication at least once, then the
+   user agent &SHOULD; present the enclosed representation to the user, since
+   it usually contains relevant diagnostic information.
 </t>
 </section>
@@ -444 +445 @@
   <x:anchor-alias value="407 (Proxy Authentication Required)"/>
 <t>
-   This code is similar to <x:ref>401 (Unauthorized)</x:ref>, but indicates that the
-   client ought to first authenticate itself with the proxy. The proxy &MUST;
-   send a <x:ref>Proxy-Authenticate</x:ref> header field (<xref target="header.proxy-authenticate"/>) containing a
-   challenge applicable to the proxy for the target resource. The
-   client &MAY; repeat the request with a suitable <x:ref>Proxy-Authorization</x:ref>
+   The <x:dfn>407 (Proxy Authentication Required)</x:dfn> status code is
+   similar to <x:ref>401 (Unauthorized)</x:ref>, but indicates that the client
+   needs to authenticate itself in order to use a proxy.
+   The proxy &MUST; send a <x:ref>Proxy-Authenticate</x:ref> header field
+   (<xref target="header.proxy-authenticate"/>) containing a challenge
+   applicable to that proxy for the target resource. The client &MAY; repeat
+   the request with a new or replaced <x:ref>Proxy-Authorization</x:ref>
    header field (<xref target="header.proxy-authorization"/>).
 </t>