nextwebgen.com

Mark Pilgrim has a new This Week in HTML 5 that features a bit new proposal for integrating HTTP authentication with HTML forms.

A common use for forms is user authentication. To indicate that
an HTTP URL requires authentication through such a form
before use, the HTTP 401 response code with a WWW-Authenticate challenge “HTML” may be used.

For this authentication scheme, the framework defined in RFC2617
is used as follows. [RFC2617]

challenge = “HTML” [ form ]

form      = “form” “=” form-name
form-name = quoted-string

The form parameter, if
present, indicates that the first form element in the
entity body whose name is the
specified string, in tree order, if any, is the login
form. If the parameter is omitted, then the first form
element in the entity body, in tree order, if any, is
the login form.

There is no credentials production for this
scheme because the login information is to be sent as a normal form
submission and not using the Authorization
HTTP header.

Mark then goes on to say:

This idea has been kicked around for more than a decade. Microsoft wrote User Agent Authentication Forms in 1999. Mark Nottingham asked the WHATWG to investigate the idea in 2004. Better late than never, Ian Hickson summarizes the feedback to date. No doubt this new proposal will generate further discussion. No browsers currently support this proposal.

The idea makes total sense to me. The old HTTP BASIC style of authentication is a dying bread due to the annoying popup style and implementation. It needs a shake up, don’t you think?