Subject: [hybi] Authentication headers

From: Wellington Fernando de Macedo <[email-masked]>
Date: Mon, 7 Jun 2010 17:34:34 -0300

Hi,

I'm updating the Mozilla's implementation of the WS protocol to its latest
version (v.76).
I know that handling the 401 http response was already removed in the v75.
But now
I've noted that even the http Authorization header has been removed.

Well, I think that the 401 http status was removed in order to prevent the
browser to
open unexpected auth dialogs to the user. Actually, I know there is the
cookie information,
but I think it isn't always enough. So, I would like to ask, why can't a
"normal"
request include the Authorization header from its page origin?

Wellington.

---

From: Wellington Fernando de Macedo <[email-masked]>
Date: Mon, 7 Jun 2010 17:45:30 -0300

Hmm, I've just found out in the Server-side requirements section:

"Other fields
      Other fields can be used, such as "Cookie", for authentication
      purposes.  Their semantics are equivalent to the semantics of the
      HTTP headers with the same names."

Perhaps in the Client-side section of the draft could be written something
similar.

2010/6/7 Wellington Fernando de Macedo <[email-masked]>