RFC 7615 / START HERE
Authentication information, before the details
Authentication-Info and Proxy-Authentication-Info are HTTP response field names, not acronyms.
An authentication scheme is a named HTTP authentication method. Some schemes need a final message after a server accepts a client’s credentials. These fields carry that scheme’s information back in the response.
The idea in one picture
Client credentials
Acceptance at server
Scheme information
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Originally defined with Digest, the fields were generalized for other schemes in this 2015 publication. RFC 9110 has since obsoleted RFC 7615 and incorporates their semantics; this guide explains the historical publication with current context.
A familiar example
A server can return final authentication data to an app, while a proxy returns its own information to its next client on the response chain. Reading these fields alone proves neither permission nor confidentiality; their parameters and checks depend on the request’s authentication scheme.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Return information after accepting credentialsAn authentication scheme is a named HTTP authentication method. Some schemes need a final message after the server accepts the client’s credentials.→
- Read parameters without inventing a schemeThe response value is a comma-separated list of name=value parameters, without an authentication-scheme prefix.→
- Forward origin information unchangedAn intermediary may carry an origin response without becoming the authority for its Authentication-Info value.→
- Keep proxy information on its response hopProxy-Authentication-Info concerns authentication to a proxy and normally applies to the next client on the response chain.→
- Gate trailers and recognize information exposureA trailer is a field sent after response content. Using one here needs explicit permission from the authentication scheme; the fields do not encrypt themselves.→
This introduction explains RFC 7615 (2015). This publication has a successor; see the related guides and the RFC status. Read the original RFC ↗