Updated auhtn/authz proposals.

simensen · simensen · commit 341f73cda4de · 2013-07-30T15:08:34.000-05:00
diff --git a/source/specs/2.md b/source/specs/2.md
@@ -32,17 +32,25 @@ interpreted as described in [RFC 2119](http://www.ietf.org/rfc/rfc2119.txt).
 
 ### Stack Authentication Middlewares
 
+#### Token
+
+A Stack authentication token represents the user or service driving the user
+agent making a request. The token MUST be stored as the `stack.authn.token`
+request attribute. The token MUST either be a string or serializable.
+
+
 #### Authentication
 
 A Stack authentication middleware is free to use whatever means necessary to
 authenticate a request. The end result of a successfully authenticated request
-is that the `stack.authentication.token` attribute is set on the request.
+should be that the `stack.authn.token` attribute on the request is set to a
+valid token.
 
 If a request has authentication credentials that are invalid for any reason a
-Stack authentication middleware MAY immediately challenge or return another
-reaponse (for example, a 400 error response).
+Stack authentication middleware MAY either immediately challenge or return
+another reaponse (for example, a 400 error response).
 
-If a request already has the `stack.authentication.token` attribute set a Stack
+If a request already has the `stack.authn.token` attribute set a Stack
 authentication middleware MUST NOT attempt to further authenticate the request.
 However, the Stack authentication middleware MAY act further upon inspecting
 the response.
diff --git a/source/specs/3.md b/source/specs/3.md
@@ -29,25 +29,18 @@ interpreted as described in [RFC 2119](http://www.ietf.org/rfc/rfc2119.txt).
    authorization fails when a request is not authenticated.
 
 
-### Stack Authorization Middlewares
+### Stack Authorization Middlewares and Applications
 
-#### Token
+Authorization MUST be based on the token stored in the `stack.authn.token`
+request attribute.
 
-Authorization should be based on the token stored in the
-`stack.authentication.token` request attribute. This token should be a string
-that can be used to gather additional information about the authenticated user
-making the request.
+If a token exists but the request is not authorized, a Stack authorization
+middleware MUST return a `403` response.
 
-#### Integration with Stack Authentication
-
-If authentication is provided by way of `stack.authentication.token` but the
-request is not authorized, a Stack authorization middleware MUST return a `403`
-response.
-
-If authentication is not provided by way of `stack.authentication.token`, a
-Stack authorization middleware SHOULD return a `401` response with a
-`WWW-Authenticate: Stack` header. This will give the appropriate Stack
-authentication middlewares an opportunity to challenge as appropriate.
+If a token does not exist, a Stack authorization middleware SHOULD return a
+`401` response with a `WWW-Authenticate: Stack` header. This will give the
+appropriate Stack authentication middlewares an opportunity to challenge as
+appropriate.
 
 
 ### Implementations
