Authentication, security & extensions
10Challenge-response authentication, origin boundaries, and registered extensions keep HTTP extensible without making every field trustworthy.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 11 ↗
RFC 9110 · § 11EXAMPLE
4 / 4
04
Extend with defined semantics.
New protocol elements need explicit behavior and interoperability rules.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Authenticate within the right protection space.
- 401 challenges origin authentication with WWW-Authenticate; 407 challenges proxy authentication separately.
- Credentials and sensitive information require appropriate transport and origin handling.
- Methods, status codes, fields, and authentication schemes have extension mechanisms and registry rules.
RFC 9110 §17 also covers injection, request smuggling, intermediary risks, privacy, and resource exhaustion. An HTTP success status alone does not establish authorization or trustworthy content.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy