3 ms·
I don't think there's any ambiguity here...the first quote indicated that a client is absolutely allowed to send auth headers without receiving a 401 response.
by mnarayan01 13y ago
I don't think there's any ambiguity here...the first quote indicated that a client is absolutely allowed to send auth headers without receiving a 401 response. I read the second quote as giving client implementers a suggestion on when they should automatically send the auth headers, without actually requiring them to do so.
- cobralibre 13y agoI agree, and the practice of sending an Authorization header without first receiving a challenge is common enough that there's a phrase for it: preemptive authentication. See, for example, the Apache HttpClient documentation: http://hc.apache.org/httpclient-legacy/authentication.html#Preemptive_Authentication http://hc.apache.org/httpclient-legacy/authentication.html#P...