[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Protocol Authentication (was Re: Collection convergence?)




Joe Gregorio wrote:


Now, mandating that a 'client' needs to be able to interact with a
server using Digest is something competely different. That *may* be
a way to increase interopability. It seems that that is the tact
that WebDAV chose, unless I am reading the spec incorrectly:

You read that correctly, but the WebDAV folks consider it a mistake.


  "RFC2518 advocates Digest Authentication. There was some concern that
   although it  doesnt transmit the password in the clear, the password
   or password  equivalent still has to reside in a file on the server
   basically in the  clear. They cant rely on that file  being secure
   and felt that Basic Authentication over SSL or other transport  level
   security was a better option."

-- http://www.webdav.org/wg/rfcdev/issues.htm

If they ever issue 2518bis, that part will have changed.

Robert Sayre