Re: stale=true in digest auth

ext Dan Winship wrote:
Jari Urpalainen wrote:
Hi !

Current library emits REAUTHENTICATE signal when the WWW-authenticate
header contains stale=true. Included a patch which changes this to the
AUTHENTICATE signal which is imo the right behavior.

Huh. I never knew about the "stale" flag. (I didn't write the original
Digest code, and haven't modified it that much since it was written...)

But there are two problems with this patch: first, emitting
"authenticate" is wrong too; it shouldn't be asking the app for the
password again at all, it should just be recomputing the digest response
from the existing password. Second, the patch puts Digest-specific
knowledge into SoupSession, which is inelegant...
right, it was a very, very quick hack...
The right fix is to fix SoupSession so that instead of always replacing
the old auth with the new auth, it calls some SoupAuth method instead to
merge the two together (and then the SoupAuthDigest implementation of
that would do the right thing with "stale").

And then we need a regression test to make sure this stays fixed in the

So anyway, thanks for the report. I'm not taking this patch as is, but
I'm working on the bug and will hopefully have it fixed soon.

-- Dan
thanks Jari

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]