[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Non-Borg servers can authenticate Borg clients (Was Re: [x

• To: xml-dev@l...
• Subject: Re: Non-Borg servers can authenticate Borg clients (Was Re: Re: Cookies at XML Europe 2004 -- Call for Participation)
• From: Elliotte Rusty Harold <elharo@m...>
• Date: Sun, 11 Jan 2004 08:19:54 -0500
• Cc: timothy_dyck@z...
• In-reply-to: <p06010206bc25d0b04532@[192.168.254.4]>
• References: <Pine.LNX.4.44L0.0401082047570.6682-100000@s...><p06010200bc248438b415@[192.168.254.4]><p06010206bc25d0b04532@[192.168.254.4]>

At 10:59 AM -0500 1/10/04, Elliotte Rusty Harold wrote:

>The big surprise is that Internet Explorer 4.0.1 for Mac OS 9, which 
>dates to 1998, supports this. That's so surprising I'm wondering if 
>maybe something weird is going on behind the scenes, like IE sending 
>a basic authentication to a request for digest authentication, which 
>Apache nonetheless accepts? I may have to do a little packet 
>snarfing of my own to see if I can figure out what's going on. Can 
>anybody recommend a good packet snarfing tool for Linux that would 
>let me see exactly what the client is sending to Apache? Maybe some 
>log  option in Apache?

I've now looked at what's actually getting sent across the wire to 
the server using ethereal, and I can confirm that Internet Explorer 
4.0.1 for Mac OS (circa 1998) supports digest authentication. Someone 
else has reported that Internet Explorer 4.0 for Windows also passes 
the test, though I haven't confirmed that with Ethereal. Still, given 
that the mac browser can do this, it doesn't seem unlikely that the 
equivalent Windows version can.

So far all the reports from later versions of IE are also successes. 
I'm beginning to think that reports of non-interoperability are 
greatly exaggerated. They may perhaps be misdiagnoses of other 
problems involving WebDAV, WebFolders, or other protocols that go 
beyond simple digest authentication for a web site. Or possibly the 
problem involves something my tests aren't exposing like whether the 
URL contains a query string or a fragment ID?

To date, the only significant failures are Lynx and Netscape 4.x.

-- 

   Elliotte Rusty Harold
   elharo@m...
   Effective XML (Addison-Wesley, 2003)
   http://www.cafeconleche.org/books/effectivexml
   http://www.amazon.com/exec/obidos/ISBN%3D0321150406/ref%3Dnosim/cafeaulaitA

• Follow-Ups:
  • Re: Non-Borg servers can authenticate Borg clients (Was Re: Re: Cookies at XML Europe 2004 -- Call for Participation)
    • From: Jeremy H. Griffith <jeremy@o...>

• References:
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Rich Salz <rsalz@d...>
  • Non-Borg servers can authenticate Borg clients (Was Re: Re: Cookies at XML Europe 2004 -- Call for Participation)
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: Non-Borg servers can authenticate Borg clients (WasRe: Re: Cookies at XML Europe 2004 -- Call for Participation)
    • From: Elliotte Rusty Harold <elharo@m...>

• Prev by Date: Re: Why is xml:base a URI *reference*?
• Next by Date: Re: Non-Borg servers can authenticate Borg clients (WasRe: Re: Cookies at XML Europe 2004 -- Call for Participation)
• Previous by thread: Re: Non-Borg servers can authenticate Borg clients (WasRe: Re: Cookies at XML Europe 2004 -- Call for Participation)
• Next by thread: Re: Non-Borg servers can authenticate Borg clients (Was Re: Re: Cookies at XML Europe 2004 -- Call for Participation)
• Index(es):
  • Date
  • Thread