For backwards compatibility, authentication scheme definitions can restrict senders to one of the two parameter value formats (token or quoted-string). This is important when deployed implementations are known to fail on one of the formats.

http

This specification generalizes Authentication-Info and Proxy-Authentication-Info from their original definition in RFC 2617 (Digest-only) so they can be used by any HTTP authentication scheme that needs to return information after credentials are accepted.

http

When multiple proxies are used within the same administrative domain (e.g., office and regional caching proxies in a corporate network), credentials generated by the user agent may be passed through the hierarchy, making Proxy-Authentication-Info appear to be forwarded as each proxy sends the same field value.

http

This document obsoletes RFC 2617, extracting and generalizing the Authentication-Info and Proxy-Authentication-Info header field definitions previously scoped only to the HTTP Digest authentication scheme.

http

A proxy forwarding a response MUST NOT modify the Authentication-Info field value in any way.

http, security

Authentication-Info can be used in any HTTP response independently of request method and status code; its semantics are defined by the authentication scheme indicated by the Authorization header field of the corresponding request.

http

Authentication-Info MAY be used inside HTTP trailers when the authentication scheme explicitly allows this use.

http

Authentication scheme definitions MUST allow both 'token' and 'quoted-string' notations for parameter values, for both senders and recipients, to allow use of generic parsing components.

http

Unlike Authentication-Info, the Proxy-Authentication-Info header field applies only to the next outbound client on the response chain, because only the client that chose a given proxy is likely to have the credentials necessary for authentication.

http

The Authentication-Info response header field communicates information after the client's authentication credentials have been accepted, including possible finalization messages such as server authentication. Its field value is a list of auth-param name/value pairs as defined in RFC 7235 Section 2.1.

http, security

The Proxy-Authentication-Info response header field is equivalent to Authentication-Info but applies to proxy authentication; its semantics are defined by the scheme indicated in the Proxy-Authorization header field of the corresponding request. Its ABNF is `Proxy-Authentication-Info = #auth-param`.

http, security

This document updates the 'Permanent Message Header Field Names' registry within IANA's 'Message Headers' registry, registering 'Authentication-Info' (http, standard, Section 3) and 'Proxy-Authentication-Info' (http, standard, Section 4).

http, registry

Adding information to HTTP responses sent over an unencrypted channel can affect security and privacy. The presence of Authentication-Info or Proxy-Authentication-Info alone reveals that HTTP authentication is in use, and scheme-specific parameters may expose additional sensitive information.

http, security, privacy

The Authentication-Info field value is defined as `Authentication-Info = #auth-param`, a comma-separated list of auth-param pairs using ABNF with the list extension from RFC 7230 Section 7.

http