Relationship between 401, Authorization and WWW-Authenticate

[mnot@…]

Are these mechanisms exclusive? I.e., can they only be used together, or can a cookie-based authentication scheme (for example) use 401?

[fielding@…]

I don't think I understand this ticket. Is it an issue or a discussion item?

401 requires WWW-Authenticate. 401 is specifically designed to signal the use of HTTP authentication. I don't think it makes any sense to use it for cookie-based authentication, since the client is completely unaware that the cookies are being used for auth.

[mnot@…]

Note that some want to put WWW-Authenticate on 200 responses; see <​http://www.w3.org/mid/492EEB95.9050001@gmx.de>.

[t.broyer@…]

Re. the use of WWW-Authenticate in non-401/407 responses, FWIW: ​http://lists.w3.org/Archives/Public/public-web-security/2010Jan/0042.html

[julian.reschke@…]

I just checked the history of this bug, following several threads, and it appears this is really a *set* of issues...

1. Relation between status code 401 and WWW-Authenticate

401 responses MUST include a WWW-Authenticate, but the opposite is not true.

Should we state more clearly in <​http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-auth-11.html#header.www-authenticate> what this field means on a 2xx response? Any response?

2. Relation between WWW-Authenticate and Authorization fields?

Does every authentication scheme need to specify the credentials in "Authorization"? <​http://tools.ietf.org/html/draft-broyer-http-cookie-auth-00> doesn't, and this doesn't seem to be a problem in practice (as long as cacheability is properly addressed)

3. Should we specify how to handle a 401/WWW-Authenticate that does not contain any known schemes?

It appears all browsers nowadays display the message payload, which clearly is the right thing to do if we ever want to deploy new schemes.

Given the fact that implementations do the right thing, do we need to say more?

[julian.reschke@…]

1) Yes, state what it means to get WWW-A on non-401. ("Authenticating may affect the response you got")

2) Yes, Authorization needs to be set because of caching implications.

[julian.reschke@…]

From [1360]:

Relationship between 401, Authorization and WWW-Authenticate (see #78)