Subject: draft-brezak-spnego-http-04

From: Henrik Nordstrom <[email-masked]>
Date: Wed, 6 Nov 2002 01:28:16 +0100

Hi,

Was reading the ID on SPNEGO over HTTP, and have some comments.

It is really unfortunate SPNEGO is yet another connection oriented 
authentication scheme where HTTP is really designed for message 
oriented authentication schemes, but it is good that you recognise 
this and have added extension headers to allow proxies to signal 
their capability to support connection oriented authentication.

   7. Security Considerations

   [...]. A proxy that correctly honors client to server
   authentication integrity will supply the "Proxy-support: Session-
   Based-Authentication" HTTP header to the client in HTTP responses
   from the proxy. [...]

However, this alone is not sufficient. You must also add a 
"Connection: Proxy-support" header to mark the extension header as a 
hop-by-hop header to protect from other proxies inbetween this proxy 
and the client.

Also, you should also keep in mind that transparently intercepting 
proxies are quite widely deployed on the Internet today, so to really 
have a reasonable chance of working the server initiating the 
"Negotiate" scheme needs to add a extension hop-by-hop header 
signalling that this connection needs to be kept end-to-end and 
negotiate (SPNEGO) only accepted by the client if this extension 
header is seen in the reply.

Also I question why "Negotiate" is defined to not apply to proxies.

    7. Security Considerations

    This mechanism is not used for HTTP authentication to HTTP
    proxies.

I see no technical reason as to why this restriction exists so that 
"Negotiate" scheme could not be applied to proxy authentication just 
like Basic/Digest/NTLM can. If used for proxy authentication the 
headers used will obviously be different, but the authentication 
scheme as such should work I believe.

Regards
Henrik Nordström
Squid HTTP Proxy Developer