Cloned from launchpad blueprint https://blueprints.launchpad.net/keystone/+spec/basic-auth.

Description:

Passing in the userid/password in the body of a request is at odds with the way that the browsers expect authentication to work.  Keystone should be able to accept userid and password via basic-auth in order to allow browser based operations against Keystone.  Once created, the token can live in a secure cookie.  TO prevent XSRF attacks, a standard header will enforce that the referring web page must be Keystone itself.  A future extension will deal with CORS support.

Specification URL (additional information):

None