Re: [STATUS] 1.3b4-dev Fri Dec 12 16:25:52 EST 1997

["Roy T. Fielding" <fi...@kiwi.ics.uci.edu>]

>I've played around with this, and looked at RFC2068 sections 11 (which says
>that the realm name is a quoted-string) and 2.2 (which says that a
>quoted-string can contain anything except '"' itself and ASCII values
>{0-31,127}).  Section 2.2 also says:
>
>:   The backslash character ("\") may be used as a single-character quoting
>:   mechanism only within quoted-string and comment constructs.
>
>so it's unclear to me whether "a string with a \"" is a valid realm name
>or not.  (Roy?)

Valid, yes -- whether a browser will puke on it or not is unknown.

>To recap, the current behaviour of
>
>  AuthName "A Nice Place"
>
>results in 'realm = ""A Nice Place""'.  Changing AuthName to TAKE1 doesn't
>completely solve this problem, since
>
>  AuthName "a string with a \""
>
>will result in 'realm = "a string with a ""' being sent - the escape is
>lost.

Process it as TAKE1 first, and then check the result for illegal characters.
We should add the backslash automatically if the parsed value contains
a double-quote or a backslash.

....Roy

Re: [STATUS] 1.3b4-dev Fri Dec 12 16:25:52 EST 1997

[Rodent of Unusual Size <Ke...@Golux.Com>]

Roy T. Fielding wrote:
> 
> >so it's unclear to me whether "a string with a \"" is a valid realm name
> >or not.  (Roy?)
> 
> Valid, yes -- whether a browser will puke on it or not is unknown.

Well, they don't seem to be getting dyspeptic over things like
'realm = ""a quoted string""', so my guess is that they're probably
treating it as an opaque entity.  (For a partial test, see if they
are honouring the case-insensitive nature of the name; I'd almost
be willing to wager that many will regard "Abc" and "ABC" as
unique realms.)  Who knows how they're locating the end of the
string..

> Process it as TAKE1 first, and then check the result for illegal characters.
> We should add the backslash automatically if the parsed value contains
> a double-quote or a backslash.

It seems to me that this will end up being useful in other cases,
so I'll make it a function.  Maybe later to-day..

Thanx for the clarification, Roy.

#ken	P-)}