On 4/13/05, David Orchard <> wrote:
> Do you really think that HTTP can move to a new version, aka HTTP 1.2?
What does a new version of HTTP have anything to do with the
questions Rich has been asking?
> And isn't the work in Web services a proper use of the HTTP Framework to
> define an authentication mechanism?
From a purely practical perspective I can see moving
security to a different level if it makes sense, for example, TLS works
at a level below HTTP. My question, to reiterate:
HTTP has an extensible authentication mechanism. What about
that mechanism is so inadequate that you can't use it to build
an authentication mechanism that meets your requirements?
Thanks,
-joe
> Dave
>
> > -----Original Message-----
> > From: Joe Gregorio [mailto:]
> > Sent: Wednesday, April 13, 2005 1:22 PM
> > To: Rich Salz
> > Cc:
> > Subject: Re: [xml-dev] What Does SOAP/WS Do that A REST System Can't?
> >
> > Rich,
> > I keep coming back to this message and starting
> > to type out replies then deleting them before
> > sending. The claims you are making are rather
> > strange. Maybe you could explain how WS-* solves
> > these problems, that of POE and Authentication, so I
> > have something to compare against.
> >
> >
> > On 3/31/05, Rich Salz <> wrote:
> > > Like Digest and BasicAuth, the two you mentioned require both
> parties to
> > > use that shared secret on every interaction. It's just like having
> to
> > > type your password into the shell after every command.
> >
> > Thanks for the analysis of both these methods, but you missed the
> point.
> > I brought them up to demostrate that HTTP auth is extensible. If the
> > current
> > schemes don't meet your requirements why aren't you working within
> > the HTTP framework to define an authentication mechanism that *does*
> > meet your needs.
> >
> > Thanks,
> > -joe
> >
> > --
> > Joe Gregorio http://bitworking.org
> >
> > -----------------------------------------------------------------
> > The xml-dev list is sponsored by XML.org <http://www.xml.org>, an
> > initiative of OASIS <http://www.oasis-open.org>
> >
> > The list archives are at http://lists.xml.org/archives/xml-dev/
> >
> > To subscribe or unsubscribe from this list use the subscription
> > manager: <http://www.oasis-open.org/mlmanage/index.php>
>
--
Joe Gregorio http://bitworking.org
