On 10/03/2009 12:26 PM, Manger, James H wrote: > The only defined operation with a realm is to compare the realm values > from different 401 responses from the same origin (scheme/host/port). Although it's not really a "defined" operation, realms are also often used in the UI by web browsers when presenting the password dialog; "The web site has requested a password for '$realm'" or something. > Once a client has learnt the realm for one resource it is reasonable to > assume any sub-resource has the same realm. This is not generically true, it's just something Basic and Digest both explicitly add to the generic realm semantics. If it was convenient for OAuth, you could say that the 401 response applies only to the exact URI that it was returned from, and user agents should not attempt to reuse the same authentication for any other URIs. Or you could do something like Digest's "domain" parameter, giving an explicit list of other URIs where the same auth can be reused. -- Dan
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.