🚀 go-pugleaf

In <19950814.131518.33@tquest.demon.co.uk> josh@tquest.demon.co.uk (Joshua Goodall) writes:

>In article <19950813.010124.70@atlas.co.uk>,
>          rsargeant@atlas.co.uk (you) wrote:

>> A little dilemma... Can someone enlighten me on this matter?
>> 
>> If I am using a proxy service such as that at http://www.demon.co.uk:8080 and
>> access Clan/private pages, can I be sure that I will not be authorizing pages
>> for users after me? (Perhaps that should be in the Acorn WWW site FAQ...)

>IIRC ArcWeb GETs the page, is told that 'authentication is required' (a
>401 response) in the HTTP header, gets said auth. from user, and
>re-requests the document *including* the authentication information.

>Assuming the auth-scheme is trapdoor (e.g. MD5) and that no-one in
>your data-hop-path is listening in, you should be able to rest easy.
>However I quote from <draft-ietf-http-v10-spec-00.txt>:

I think that the original point was that www.demon.co.uk would actually
cache the document when it comes back for him and the question was, would
this cached copy be presented to anyone else who requested that document
through the proxy.

The answer is no it wouldn't, although if you should request it again
you will get the cached copy.  The reason for this is that the some of
the client sent headers are stored with the cached copy - this includes
things like the Accept: headers and some of the server headers such as the
WWW-Authenticate header.  It is *possible* for the proxy to perform the
authentication checking (providing the realm method is Basic) since it's
just a simple BASE64 transformation, so if someone requests the document
without sending the correct header, the proxy can return the 401
Authorization Needed response AND subsequently supply the document when a
matching Authorization header is presented.

However, I don't believe that the current cacheing servers (CERN &
Netscape Proxy Server) do this kind of trickery.  It is certainly dodgy and
is the subject of ongoing discussion in W3C circles.  There is a lot of
'frank exchanges of views' :-)

-- 
Stewart Brodie                     S.N.Brodie@ecs.soton.ac.uk
Department of Electronics & Computer Science, University of Southampton
http://dsse.ecs.soton.ac.uk/       http://delenn.ecs.soton.ac.uk/