16 Jul
2009
16 Jul
'09
6:11 p.m.
2009/7/16 Klaus Darilion <klaus.mailinglists(a)pernau.at>at>:
Iñaki Baz Castillo schrieb:
What I mean is that, response calculation should be done even if nonce
is reused. If not, there is no way to send "stolen=true" in 401/407.
--
Iñaki Baz Castillo
<ibc(a)aliax.net>
However, to anounce "stale=true" in
401/407 response the
credentials must be verified.
It would be sufficient to check if the nonce is reused, response calculation
could be done afterwards