RE: stupid HTTP question

> From: Ben Collins-Sussman [mailto:sussman@collab.net]
> Sent: 16 October 2001 21:43
>
> In our previous security discussions on this list, we've all been very
> careful not to mix up the concepts of "authentication" and
> "authorization".
>
> But now I just noticed that when neon grabs authentication info from
> the client, it puts the crypted data into a standard HTTP header field
> called "authorization":
>
> Authorization: Basic c3Vzc21eebjz93Fzb3Vw
>
> Why, oh why, is this the case. Does HTTP itself confuse the two issues?!

Unfortunately it does. See RFC2617 for details. Specifically sections
3.2.1, 3.2.2 and 3.5(example).

Sander

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Sat Oct 21 14:36:44 2006