Re: Speifying mechanisms [was RE: XML2004Hackathon]

[Greg Stein <gstein@xxxxxxxxxx>]

On Wed, Oct 27, 2004 at 11:18:06AM +0100, Mark Birbeck wrote:
>...
> > That's what a status code of 401 and the 
> > WWW-Authenticate: header are for.
> 
> Yes, but that's incredibly long-winded ... you have to fail before you know
> how to succeed.

But that is exactly how HTTP is specified, and how it has worked for many
years. I don't see the need to redesign that or come up with other
solutions. Note that some clients have a way to cache authentication
information and they'll proactively supply it to the server when they
connect (which saves the round-trip you mention).

IMO, I don't see this as a problem. This is simply how HTTP works.

>...
> (Note also that WWW-Authenticate is protocol dependent, which -- so far --
> much of Atom is not.)

The Atom publishing protocol *is* HTTP specific. Completely. I haven't
heard of any desire nor attempt to deal with protocols other than HTTP. So
I'd suggest that being "specific" is not a problem.

Cheers,
-g