Read parameters without inventing a scheme
02The response value is a comma-separated list of name=value parameters, without an authentication-scheme prefix.
Example note=ready is not #auth-param: a scheme name belongs in the corresponding request’s Authorization field, not before this response parameter list.
Source for this drawing: RFC 7615 · Read RFC section 3.1 ↗
New to this? Start hereA quick picture + helpful background
A request starts a conversation.
A client asks for a resource. A server sends a response. The method, address, headers, and status explain what that conversation means.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
This guide explains the 2015 publication. Superseded by RFC 9110.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Values use token or quoted-string syntax. A comma inside a quoted string is data, not a list separator; a quoted-pair decodes to the octet after its backslash.
- Values use token or quoted-string syntax. A comma inside a quoted string is data, not a list separator; a quoted-pair decodes to the octet after its backslash.
- Scheme definitions need to allow both notations for senders and recipients; for backward compatibility they can restrict senders to one variant. This does not permit a recipient to assume only that variant.
- The imported list syntax permits an empty list. Senders MUST NOT generate empty list elements; recipients MUST ignore a reasonable number. The teaching parser’s length/count caps are local resource limits.
Generic syntax is not scheme verification. RFC 7235§2.1 defines auth-param and case-insensitive parameter names; RFC 7230§3.2.6 defines tokens/quoted strings and§7 the list rules. Repeated names are preserved by this teaching parser for scheme-level handling; it does not invent a universal duplicate resolution rule. No Basic or Digest implementation is claimed.
Read the RFC section ↗