🚀 go-pugleaf

In article <19950813.010124.70@atlas.co.uk>,
          rsargeant@atlas.co.uk (you) wrote:

> A little dilemma... Can someone enlighten me on this matter?
> 
> If I am using a proxy service such as that at http://www.demon.co.uk:8080 and
> access Clan/private pages, can I be sure that I will not be authorizing pages
> for users after me? (Perhaps that should be in the Acorn WWW site FAQ...)

IIRC ArcWeb GETs the page, is told that 'authentication is required' (a
401 response) in the HTTP header, gets said auth. from user, and
re-requests the document *including* the authentication information.

Assuming the auth-scheme is trapdoor (e.g. MD5) and that no-one in
your data-hop-path is listening in, you should be able to rest easy.
However I quote from <draft-ietf-http-v10-spec-00.txt>:

   Proxies must be completely transparent regarding user agent access 
   authentication. That is, they must forward the WWW-Authenticate and 
   Authorization headers untouched. HTTP/1.0 does not provide a means 
   for a client to be authenticated with a proxy -- this feature will 
   be available in future versions of HTTP.


-- 
Joshua Goodall
TECHNIQUEST Exhibit Developer
josh@tquest.demon.co.uk               PGP key: mailto:pgp@tquest.demon.co.uk