Subject: Re: [saag] Reminder: Call for Proposals - HTTP/2.0 and HTTP

From: Sam Hartman <[email-masked]>
Date: Fri, 08 Jun 2012 18:33:25 -0400

On May 15, Nico and I had an exchange where I said that I thought
authentication for things like ATOMPUB and other non-browser things on
top of HTTP needed to happen at the HTTP layer rather than at the
application layer.
I was sort of surprised that we were disagreeing about that as we've
discussed the problem multiple times.

It turns out it was a semantic problem.  I believe that if you're
carrying an ATOMPUB request--for example trying to publish some web
content, then whatever information you need in that POST request for
authentication needs to be at the HTTP layer to fit well with the design
of ATOMPUB.

The sort of separation Nico is talking about works fine with that.  In
Nico's model, you may end up establishing an authentication session; how
that's done is best handled above the HTTP request layer as Nico
proposes.  However once you get that session state there are some
protocols where it seems like indicating the session in use is best done
at the HTTP layer.  We both seem to believe that's the case.

So, it turns out there was no significant disagreement after all.