Welcome back to "This Week in HTML 5," where I'll try to summarize the major activity in the ongoing standards process in the WHATWG and W3C HTML Working Group.
A common use for forms is user authentication. To indicate that
an HTTP URL requires authentication through such a form
before use, the HTTP 401 response code with a WWW-Authenticate challenge "HTML" may be used.
For this authentication scheme, the framework defined in RFC2617
is used as follows. [RFC2617]
challenge = "HTML" [ form ]
form = "form" "=" form-name
form-name = quoted-string
The form parameter, if
present, indicates that the first form element in the
entity body whose name is the
specified string, in tree order, if any, is the login
form. If the parameter is omitted, then the first form
element in the entity body, in tree order, if any, is
the login form.
There is no credentials production for this
scheme because the login information is to be sent as a normal form
submission and not using the Authorization
HTTP header.
r2423 specifies how <object> elements are submitted in forms. Unbeknownst to me, this feature was present in HTML 4 and is supported across multiple browsers. If a plugin exposes a value getter, the name of the <object> element is submitted with the value exposed by the plugin. [<object> form submission example, Mozilla bug 188938]
r2434 seriously revamps the concept of "vaguer moments in time." r2433 notes, correctly, that there is no year zero in the Gregorian calendar. r2437 further refines the calculation of dates before 1582. [date and time discussion]
r2426 clarifies the fallback behavior of the <object> element.
r2427 documents existing browser behavior in sending all attributes and attribute values to a plugin invoked from an <object> element. Previously, HTML 5 has specified that only specific parameters were sent, but browsers consistently send all attributes, so there it is.
r2424 explains the intended audience of the HTML 5 specification itself.
Tune in next week for another exciting episode of "This Week in HTML 5."
This entry was posted
on Tuesday, November 25th, 2008 at 21:38 and is filed under Weekly Review.
You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Should the Location header not be used in this instance? I would argue that if a client requests a resource X and instead receives a resource Y consisting of a login form, that this authentication method isn’t properly returning the requested data. I’m not completely sure on this, but it doesn’t sound RESTful. Shouldn’t the Location header be used (in conjunction with the WWW-Authenticate header: “HTML“) to provide the URL of the authentication form with which to authenticate?
Jason, it is “RESTful” as it integrates with the way HTTP envisions authentication to work. The only difference is that the Web page provides the authentication form rather than the browser.
Having said that, the feature is currently dropped again from HTML due to some issues. It might come to life again in a separate document.
November 25th, 2008 at 22:03
Should the
Locationheader not be used in this instance? I would argue that if a client requests a resource X and instead receives a resource Y consisting of a login form, that this authentication method isn’t properly returning the requested data. I’m not completely sure on this, but it doesn’t sound RESTful. Shouldn’t theLocationheader be used (in conjunction with theWWW-Authenticateheader: “HTML“) to provide the URL of the authentication form with which to authenticate?November 26th, 2008 at 06:03
[...] Mark Pilgrim: The big news this week is a radical proposal for integrating HTTP authentication with HTML forms. [...]
November 29th, 2008 at 09:13
Jason, it is “RESTful” as it integrates with the way HTTP envisions authentication to work. The only difference is that the Web page provides the authentication form rather than the browser.
Having said that, the feature is currently dropped again from HTML due to some issues. It might come to life again in a separate document.
December 2nd, 2008 at 11:54
[...] Pilgrim has a new This Week in HTML 5 that features a bit new proposal for integrating HTTP authentication with HTML [...]
December 3rd, 2008 at 05:22
[...] Pilgrim has a new This Week in HTML 5 that features a bit new proposal for integrating HTTP authentication with HTML [...]
December 3rd, 2008 at 05:24
[...] The good news this week that there is a new “radical proposal for integrating HTTP authentication with HTML forms.” [...]
December 10th, 2008 at 17:42
[...] The WHATWG Blog Please leave your sense of logic at the door, thanks! « This Week in HTML 5 - Episode 14 [...]