Advertise UTF-8 without changing the default
03A server can advertise how it wants non-ASCII credentials encoded, while old clients may keep their existing behavior.
74 65 73 74 3A 31 32 33 C2 A3 encodes to dGVzdDoxMjPCow==. Authorization carries Basic plus that token only. Proxy use changes the field name to Proxy-Authorization.
Source for this drawing: RFC 7617 · Read RFC section 2.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- NFC
- Unicode Normalization Form C, a defined normalization operation; it is not encryption.
- UTF-8
- A byte encoding for Unicode characters.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The optional charset parameter belongs on the challenge. Its only allowed value here is UTF-8, matched case-insensitively; it is purely advisory.
- The optional charset parameter belongs on the challenge. Its only allowed value here is UTF-8, matched case-insensitively; it is purely advisory.
- UTF-8 advertises an expectation of Unicode Normalization Form C (NFC), then UTF-8 octets. It does not make UTF-8 the unconditional default for every client.
- Basic credentials remain a single token68 value: do not append charset to Authorization. Recipients MUST ignore unknown challenge parameters.
- Under §2.1, recipients MUST support the referenced UsernameCasePreserved profile characters except colon for user-id, and the OpaqueString profile characters for password. Agreement on encoding still matters.
The profiles are the RFC 7613 profiles referenced by the immutable RFC 7617; this guide does not redefine Unicode processing. The official test / 123£ example is already NFC. Appendix B explains legacy clients may ignore charset; mixed legacy/UTF-8 attempts and implicit retries need care to avoid login-failure/lockout side effects. Reported erratum 9174 is unverified and is not adopted as a new normative rule.
Read the RFC section ↗