[6600] in www-talk@info.cern.ch
Re: authentication cleanups
daemon@ATHENA.MIT.EDU (Daniel W. Connolly)
Wed Nov 9 20:17:16 1994
Date: Thu, 10 Nov 1994 01:42:44 +0100
Errors-To: listmaster@www0.cern.ch
Reply-To: connolly@hal.com
From: "Daniel W. Connolly" <connolly@hal.com>
To: Multiple recipients of list <www-talk@www0.cern.ch>
In message <199411092345.RAA24811@austin.BSDI.COM>, Tony Sanders writes:
>Perhaps servers should return a indication of what area is
>covered by the authentication. For example:
>
>Client:
> GET /protected/recipies/secret-sauce/ingredients HTML/1.0
> ...
>Server:
> 401 Unauthorized
> WWW-Authenticate: Basic realm="burgers_and_fries"
> WWW-Realm-Partial: /protected/recipies/, /protected/foods/
..
>Does this make sense?
In a way, yes. But truly anal security fiends would say that this is
divulging potentially sensitive information. They get nervous when you
tell folks the difference between "file not found" and "unauthorized".
It's kinda like having a unix loging program that goes:
login: fred
username OK... passwd: ****
login: fredd
username no good.
login:
As long as you're using the basic authentication scheme, you're certainly
not in the league of anal security fiends, and this may be OK.
Dan
