Ah, didn't realize that. Thanks for pointing it out. I suppose the header should contain some sort of nonce, then. To keep things as simple as possible, I prop

Ah, didn't realize that. Thanks for pointing it out. I suppose the header should contain some sort of nonce, then. To keep things as simple as possible, I propose: Auth-Spec: type=plain; action=/login; method=POST; fields=email,password,nonce:8977340152 The "colon syntax" could also be used where the name of a required field is different from the defaults (another problem that I overlooked). For example, WordPress uses "log" for the username and "pwd" for the password, so it would be "fields=log:username,pwd:password". It wouldn't be possible to require a nonce, though, because it would break backward compatibility with sites that are already vulnerable anyway. As an option for new or updated websites, though, it would be a good idea to add a nonce field.