RFC 7236

RFC 7236: Initial HTTP Authentication Scheme Registrations 🎀

okay bestie, this one is a Category: Informational doc 🧚 (so it's not a Standards Track spec, just vibes and facts). It's by J. Reschke from greenbytes, dated June 2014, with ISSN: 2070-1721. The title block doesn't list anything it obsoletes or updates, so nothing is being replaced or amended here 💅

Abstract

this doc registers HTTP authentication schemes that were already defined in RFCs before the IANA HTTP Authentication Scheme Registry existed 🦋 so they finally get a proper home, no cap 💖

Status of This Memo

not a Standards Track spec ✨ it's published for info purposes only 🌸

it's an IETF product 👑 it reflects the consensus of the IETF community, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). not every IESG-approved doc is a candidate for any level of Internet Standard, see Section 2 of RFC 5741 🙈

all the info about this doc's current status, any errata, and how to give feedback lives at http://www.rfc-editor.org/info/rfc7236 💜

Copyright Notice

Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. 🌈

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. read those carefully, because they spell out your rights and restrictions for this doc 🫶

if you extract Code Components from this doc, they must include the Simplified BSD License text described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as the Simplified BSD License describes 💅

Table of Contents

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 2
2.  Security Considerations . . . . . . . . . . . . . . . . . . . . 2
3.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 2
4.  Normative References  . . . . . . . . . . . . . . . . . . . . . 3

---

1. Introduction ✨

so this doc is the registration paperwork for HTTP authentication schemes that were defined in RFCs before the IANA HTTP Authentication Scheme Registry was set up 🎀 it's giving "finally putting everyone in the same group chat" 💖

2. Security Considerations 🔥

there are no security considerations for the registration itself 🙈

the security considerations for each individual authentication scheme ought to be discussed in the specs that define them. so go read those, periodt 💀

3. IANA Considerations 🦋

the registrations below were added to the IANA "Hypertext Transfer Protocol (HTTP) Authentication Scheme Registry" at <http://www.iana.org/assignments/http-authschemes> (see Section 5.1 of [RFC7235]) 🧚

+----------------+------------+-------------------------------------+
| Authentication | Reference  | Notes                               |
| Scheme Name    |            |                                     |
+----------------+------------+-------------------------------------+
| Basic          | [RFC2617], |                                     |
|                | Section 2  |                                     |
| Bearer         | [RFC6750]  |                                     |
| Digest         | [RFC2617], |                                     |
|                | Section 3  |                                     |
| Negotiate      | [RFC4559], | This authentication scheme violates |
|                | Section 3  | both HTTP semantics (being          |
|                |            | connection-oriented) and syntax     |
|                |            | (use of syntax incompatible with    |
|                |            | the WWW-Authenticate and            |
|                |            | Authorization header field syntax). |
| OAuth          | [RFC5849], |                                     |
|                | Section    |                                     |
|                | 3.5.1      |                                     |
+----------------+------------+-------------------------------------+

⚠️ heads up: Negotiate gets a flag in the Notes column 🙈 it's called out as violating both HTTP semantics (because it's connection-oriented) and HTTP syntax (its syntax clashes with the WWW-Authenticate and Authorization header field syntax). the table's the boss, so check it directly 💅

4. Normative References 💜

[RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., Leach, P., Luotonen, A., and L. Stewart, "HTTP Authentication: Basic and Digest Access Authentication", RFC 2617, June 1999. 🌸

[RFC4559] Jaganathan, K., Zhu, L., and J. Brezak, "SPNEGO-based Kerberos and NTLM HTTP Authentication in Microsoft Windows", RFC 4559, June 2006. 🧚

[RFC5849] Hammer-Lahav, E., "The OAuth 1.0 Protocol", RFC 5849, April 2010. 🦋

[RFC6750] Jones, M. and D. Hardt, "The OAuth 2.0 Authorization Framework: Bearer Token Usage", RFC 6750, October 2012. 🌈

[RFC7235] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Authentication", RFC 7235, June 2014. 👑

Author's Address 🎀

Julian F. Reschke greenbytes GmbH Hafenweg 16 Muenster, NW 48155 Germany

EMail: julian.reschke@greenbytes.de URI: http://greenbytes.de/tech/webdav/ 🫶