Re: Please review: http gss authentication mech

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Tue, Nov 14, 2006 at 01:07:10AM +0100, Martin Rex wrote:
> Traditional Web-Browsers have only limited functionality to replicate
> session authentication tokens in successor requests.
>  - basic authentication credentials
>  - cookies
> however only cookies can be set on request of the server.
> 
> It would have been a good idea to have the browser replicate
> a server-issued (crypgraphically strong) token on a www-authenticate:
> header field for every successive request after a gss/spnego handshake,
> but it appears the designers of the rfc4559 authentication scheme forgot to
> specify this, so right now, the use of non-persistent cookies and
> a preference or requirement of an SSL/TLS protected communication channel
> is probably the most portable design approach (with the least impact
> on the creative features of middle-boxes).  If reverse proxies with
> load balacing to the backend are involved, the session re-authentication
> token must contain enough plaintext information for the reverse proxy
> to find the backend server that created this session for repeated
> or new network connections.

Yes, we shan't forget that.  It's crucial for HTTP 1.0 operation.

Nico
-- 

_______________________________________________
Kitten mailing list
Kitten at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten