Gate trailers and recognize information exposure
05A trailer is a field sent after response content. Using one here needs explicit permission from the authentication scheme; the fields do not encrypt themselves.
On an unencrypted response path, an observer can see the field name and any visible parameters. The field provides no automatic encryption; this is a security comparison, not a continuation of the permitted-trailer flow.
Source for this drawing: RFC 7615 · Read RFC section 3 ↗
New to this? Start hereA quick picture + helpful background
A request starts a conversation.
A client asks for a resource. A server sends a response. The method, address, headers, and status explain what that conversation means.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
This guide explains the 2015 publication. Superseded by RFC 9110.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Authentication-Info can be sent inside trailers only when the authentication scheme explicitly allows it. Trailer support in HTTP alone is insufficient.
- Authentication-Info can be sent inside trailers only when the authentication scheme explicitly allows it. Trailer support in HTTP alone is insufficient.
- RFC 7615§5 warns that unencrypted responses reveal that HTTP authentication is used, and scheme-specific parameters can expose additional information.
- Parsing a field or allowing a trailer does not establish confidentiality, server authentication, or authorization. Those require the scheme’s checks and appropriate transport protection.
The first two scenes are placement alternatives, not a claim that responses must defer authentication data to trailers or trust content before verification. RFC 9110§11.7.3 explicitly states the corresponding proxy trailer rule;§§11.6.3/11.7.3 are current successor guidance. This guide does not model trailer framing or a cryptographic protocol.
Read the RFC section ↗