Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Spec WWW-Authenticate and Proxy-Authenticate handling in HTTP-network-or-cache fetch #1766

Open
gmta opened this issue Aug 13, 2024 · 0 comments
Labels
needs concrete proposal Moving the issue forward requires someone to figure out a detailed plan topic: http

Comments

@gmta
Copy link

gmta commented Aug 13, 2024

What is the issue with the Fetch Standard?

The current HTTP-network-or-cache fetch specification leaves checking the WWW-Authenticate header open for interpretation; ignoring it might trigger an infinite HTTP 401 loop re-asking a username and password to send with the new requests:

fetch/fetch.bs

Lines 5873 to 5874 in 4cb3cf2

<li class=XXX><p>Needs testing: multiple `<code>WWW-Authenticate</code>` headers, missing,
parsing issues.

Similarly, HTTP 407 handling has outstanding Proxy-Authenticate header handling that needs to be specced:

fetch/fetch.bs

Lines 5918 to 5919 in 4cb3cf2

<li class=XXX><p>Needs testing: multiple `<code>Proxy-Authenticate</code>` headers, missing,
parsing issues.

@annevk annevk added topic: http needs concrete proposal Moving the issue forward requires someone to figure out a detailed plan labels Aug 13, 2024
gmta added a commit to gmta/ladybird that referenced this issue Aug 13, 2024
If the HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshes out. Raised an upstream issue to do so:

  whatwg/fetch#1766
gmta added a commit to gmta/ladybird that referenced this issue Aug 13, 2024
If the HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshes out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.
gmta added a commit to gmta/ladybird that referenced this issue Aug 13, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshes out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.
gmta added a commit to gmta/ladybird that referenced this issue Aug 13, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshed out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.
gmta added a commit to gmta/ladybird that referenced this issue Aug 13, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshed out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.

Co-Authored-By: Victor Tran <[email protected]>
tcl3 pushed a commit to LadybirdBrowser/ladybird that referenced this issue Aug 13, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshed out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.

Co-Authored-By: Victor Tran <[email protected]>
nico pushed a commit to nico/serenity that referenced this issue Nov 8, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshed out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.

Co-Authored-By: Victor Tran <[email protected]>
(cherry picked from commit e7984a77116d47fde150f81f6e18cae6aaa147ad)
nico pushed a commit to SerenityOS/serenity that referenced this issue Nov 8, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshed out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.

Co-Authored-By: Victor Tran <[email protected]>
(cherry picked from commit e7984a77116d47fde150f81f6e18cae6aaa147ad)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs concrete proposal Moving the issue forward requires someone to figure out a detailed plan topic: http
Development

No branches or pull requests

2 participants