[Commentor] LC-1991 Francois Daoust (archived comment) [Working Group decision] On your first point, we think that the tests should be carried on the response body because, as specified in the HTTP (RFC 2616) section 10.4.2 401 Unauthorized, the body of the HTTP Status 401 response should be presented to the user if the authentication fails: "If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user SHOULD be presented the entity that was given in the response, since that entity might include relevant diagnostic information" On your second point, we think that the text deserved to be clarified and updated the relevant part to state: "If authentication information was supplied in the HTTP request (i.e. authentication failed) or if no authentication information is available, FAIL" See: http://www.w3.org/2005/MWI/BPWG/Group/Drafts/mobileOK-Basic-1.0-Tests/080707r#http_response [Commentor reply] yes [Comment] 
* About the treatment of HTTP Status 401: - Why should tests be applied to the response body of such an HTTP response? The body will never be touched by any browser during the first pass (when authentication credentials have not already been sent) AFAICT. Besides, it wouldn't make any sense to display the resource if it's an included image for instance. It's perfectly normal to count the response in EXTERNAL_RESPONSE and PAGE_SIZE_LIMIT, but I suggest updating the "Carry out tests on the response" to "Do not carry out tests on the response", especially given the fact that the tests FAIL when credentials are wrong (and so there's no need to test the response body anyway even for the second pass) - "Re-request the resource using authentication information" could deserve some clarification. What if the checker doesn't have any authentication information? I would clarify this with "Re-request the resource using authentication information if available or FAIL" (where FAIL would be HTTP_RESPONSE-7)