IPFYI
RFC 7235 Proposed Standard

Hypertext Transfer Protocol (HTTP/1.1): Authentication

R. Fielding, J. Reschke · 2014-06

Abstract

The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypermedia information systems. This document defines the HTTP Authentication framework, as well as the 'Basic' and 'Bearer' authentication schemes.

Why This RFC Matters

RFC 7235 defined the extensible HTTP authentication framework — the challenge/response model using WWW-Authenticate and Authorization headers that underpins all HTTP-level authentication. The 401 Unauthorized and 407 Proxy Authentication Required status codes, the realm concept, and the auth-scheme/auth-params extensibility model defined here are used by Basic auth, Digest auth, Bearer token auth (OAuth 2.0), and virtually every other HTTP authentication mechanism. As part of the HTTP/1.1 specification revision, it obsoleted RFC 2617 and provided a cleaner foundation for OAuth and JWT-based bearer token authentication.

Supersession Chain

관련 프로토콜

HTTP HTTPS

관련 용어

authentication oauth jwt ssl-tls

Security에서 더 보기

RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)