Network Working Group R. Fielding Request for Comments: 2616 ...

whose version is HTTP/1.0 or lower, then the sender MUST include ineach warning-value a warn-date that matches the date in the response.If an implementation receives a message with a warning-value thatincludes a warn-date, and that warn-date is different from the Datevalue in the response, then that warning-value MUST be deleted fromthe message before storing, forwarding, or using it. (This preventsbad consequences of naive caching of Warning header fields.) If allof the warning-values are deleted for this reason, the Warning headerMUST be deleted as well.14.47 WWW-AuthenticateThe WWW-Authenticate response-header field MUST be included in 401(Unauthorized) response messages. The field value consists of atleast one challenge that indicates the authentication scheme(s) andparameters applicable to the Request-URI.WWW-Authenticate = "WWW-Authenticate" ":" 1#challengeThe HTTP access authentication process is described in "HTTPAuthentication: Basic and Digest Access Authentication" [43]. Useragents are advised to take special care in parsing the WWW-Authenticate field value as it might contain more than one challenge,or if more than one WWW-Authenticate header field is provided, thecontents of a challenge itself can contain a comma-separated list ofauthentication parameters.15 Security ConsiderationsThis section is meant to inform application developers, informationproviders, and users of the security limitations in HTTP/1.1 asdescribed by this document. The discussion does not includedefinitive solutions to the problems revealed, though it does makesome suggestions for reducing security risks.Fielding, et al. Standards Track [Page 150]RFC 2616 HTTP/1.1 June 199915.1 Personal InformationHTTP clients are often privy to large amounts of personal information(e.g. the user's name, location, mail address, passwords, encryptionkeys, etc.), and SHOULD be very careful to prevent unintentionalleakage of this information via the HTTP protocol to other sources.We very strongly recommend that a convenient interface be providedfor the user to control dissemination of such information, and that