HTTPsec Authentication Protocol

8. Cache Considerations

Implementers should be aware of how authenticated transactions interact with proxy caches. The HTTP/1.1 [HTTP] [ 14.8] specifies that when a shared cache has received a request containing an Authorization header and a response from relaying that request, it MUST NOT return that response as a reply to any other request.

Note also that whereas the HTTP/1.1 specification presents three exceptions to this rule, none of these exceptions are applicable to the authentication scheme here described. This is a result of the per-message uniqueness constraints introduced by various protocol directives.

Consequently, to make the non-cacheability of messages explicit the Expires response header [HTTP][ 14.21] MUST be set by the responder to the current system clock time, during the preparation of a response's "WWW-Authenticate: httpsec/1.0 continue" header directives. This is necessary for subsequent response validation, as the value of the Expires response header features in the computation of mac directives.

Also, the requirement that the no-transform directive [HTTP][ 14.9.5] MUST be set in a mandatory Cache-Control response header [HTTP][ 14.9] enforces specific modification constraints on transparent proxies that apply to certain headers - see [HTTP][ 13.5.2].