& XSLT On Wed, Apr 13, 2005 at 10:54:26PM -0400, Rich Salz wrote:
>  As I understand it, HTTP auth is somewhat extensible.  A client
>  can make a request, and the server can respond with a challenge.
>  The client uses that challenge to authenticate itself, re-issue
>  the request, and verify the server's identity.
>  
>  How can the client get the server's identity before sending any
>  "real" data?  A well-known URI or a new method? How can the server
>  challenge the client to prove it's identity without requiring state
>  on the server?
>  
>  I believe the very statelessness of HTTP and REST makes it
>  impossible.

Architectural constraints such as statelessness, are constraints on
form, not function; what you're talking about *is* possible.  The
issue will be whether the larger message size in the stateless
solution will be acceptable or not.  How much state are you're talking
about?

Mark.
-- 
Mark Baker.   Ottawa, Ontario, CANADA.        http://www.markbaker.ca

-----------------------------------------------------------------
The xml-dev list is sponsored by XML.org <http://www.xml.org> , an
initiative of OASIS <http://www.oasis-open.org> 

The list archives are at http://lists.xml.org/archives/xml-dev/

To subscribe or unsubscribe from this list use the subscription
manager: <http://www.oasis-open.org/mlmanage/index.php>