iAuth: HTTP Authentication Framework Integrated into HTML Forms

Current Web authentication methods have well-known weaknesses. Forms and cookies, which are most commonly used, have the long-standing privacy issue raised by tracking. URI sessions, which are used in some mobile services like i-mode 1.0, cause session adoption vulnerability. HTTP provides an access authentication framework, but it is rarely used because it lacks presentational control. This paper proposes iAuth, which brings presentational control to the HTTP access authentication framework. iAuth enables servers to provide log-in forms. iAuth does not have its own authentication mechanism and can support any mechanism including Basic and Digest authentications. Since iAuth has backward compatibility with legacy systems, developers can freely introduce iAuth into their Web sites or browsers as needed. Experiments confirm its correct operation; an iAuth server is shown to support not only an iAuth client but major legacy browsers. We believe that iAuth will resolve the long-standing issues in Web authentication.