Search code examples
httpmd5rfc

What does <"> mean in an RFC? What about `#1`?


In this RFC: https://www.rfc-editor.org/rfc/rfc2617#page-8 we have this:

3.2.1 The WWW-Authenticate Response Header

If a server receives a request for an access-protected object, and an acceptable Authorization header is not sent, the server responds with a "401 Unauthorized" status code, and a WWW-Authenticate header as per the framework defined above, which for the digest scheme is utilized as follows:

  challenge        =  "Digest" digest-challenge

  digest-challenge  = 1#( realm | [ domain ] | nonce |
                      [ opaque ] |[ stale ] | [ algorithm ] |
                      [ qop-options ] | [auth-param] )


  domain            = "domain" "=" <"> URI ( 1*SP URI ) <">
  URI               = absoluteURI | abs_path
  nonce             = "nonce" "=" nonce-value
  nonce-value       = quoted-string
  opaque            = "opaque" "=" quoted-string
  stale             = "stale" "=" ( "true" | "false" )
  algorithm         = "algorithm" "=" ( "MD5" | "MD5-sess" |
                       token )
  qop-options       = "qop" "=" <"> 1#qop-value <">
  qop-value         = "auth" | "auth-int" | token

The meanings of the values of the directives used above are as

In understand that | means concatenation, [] means that the thing can or can not appear. What does 1# mean? What about <"> and 1*SP? On the RFC begining there's no explanation for these.


Solution

    1. You are looking at outdated documents. For this piece, you should look at RFC 7235.

    2. ABNF is defined in RFC 5234 (wtih extensions from RFC 7231). You should find those references based on the section "Syntax Notation" in RFC 7235.

    (and, for FWIW, RFC 2617 points to the definitions as well, see Section 1.1).