RFCs about HOBA | RFC Editor

Your browser has JavaScript disabled. Most of this site works without JS, but some features require it. If something seems broken please try enabling JavaScript and reloading the page.
The JavaScript used by this site is served directly from IETF infrastructure and does not include any code that links to a third party service.

Skip to content

The RFC Series

For Authors

About Us

User menu

Theme

HOBA (HTTP Origin-Bound Authentication), the digital-signature scheme binding a client key pair to an origin in place of a password

HOBA RFCs (1)

Sort by

RFC 7486: HTTP Origin-Bound Authentication (HOBA)
Experimental
S. Farrell
P. Hoffman
M. Thomas
March 2015
IETF publication
Security Area
Abstract
HTTP Origin-Bound Authentication (HOBA) is a digital-signature-based design for an HTTP authentication method. The design can also be used in JavaScript-based authentication embedded in HTML. HOBA is an alternative to HTTP authentication schemes that require passwords and therefore avoids all problems related to passwords, such as leakage of server-side password databases.
Abstract
HTTP Origin-Bound Authentication (HOBA) is a digital-signature-based design for an HTTP authentication method. The design can also be used in JavaScript-based authentication embedded in HTML. HOBA is an alternative to HTTP authentication schemes that require passwords and therefore avoids all problems related to passwords, such as leakage of server-side password databases.

Get notified when:

RFC changes to status, obsoleted by, updates, updated by, or subseries.
New RFC added to this subject or below
The subject was merged into another.