It is up to the browser writers to do this in a generic way so they can
support multiple authentication schemes. It would probably help if the
server returned a header like Accept-Authentication: with a list of the
authentication protocols it accepts. Tim BL, do you want to address this
in the HTTP spec?
Another way to attack the problem is just inject the raw authentication
protocol in the stream at some point (hand off the socket to an
external program and let it do all the work). Tim: is this allowed? What
do you think about it? I don't think it would break anything since it
would only happen if both the client and server agreed on the
Authentication: protocol. Comments?
I hope to do some prototyping at some point in the next few weeks.
FYI: the problem I'm trying to solve is not so much local access to
documents (you could simply check IP address for that and get most of what
you need) but rather the purchasing of books and other services over the
Internet.
--sanders