-
Notifications
You must be signed in to change notification settings - Fork 331
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Spec WWW-Authenticate and Proxy-Authenticate handling in HTTP-network-or-cache fetch #1766
Labels
needs concrete proposal
Moving the issue forward requires someone to figure out a detailed plan
topic: http
Comments
annevk
added
topic: http
needs concrete proposal
Moving the issue forward requires someone to figure out a detailed plan
labels
Aug 13, 2024
gmta
added a commit
to gmta/ladybird
that referenced
this issue
Aug 13, 2024
If the HTTP 401 response we get does not contain a `WWW-Authenticate` header, we should not trigger the logic to ask the user for credentials and retry the request. This part is hinted at in a TODO / 'Needs testing' remark in the spec but needs to be fleshes out. Raised an upstream issue to do so: whatwg/fetch#1766
gmta
added a commit
to gmta/ladybird
that referenced
this issue
Aug 13, 2024
If the HTTP 401 response we get does not contain a `WWW-Authenticate` header, we should not trigger the logic to ask the user for credentials and retry the request. This part is hinted at in a TODO / 'Needs testing' remark in the spec but needs to be fleshes out. Raised an upstream issue to do so: whatwg/fetch#1766 This fixes login forms triggering an infinite fetch loop when providing incorrect credentials.
gmta
added a commit
to gmta/ladybird
that referenced
this issue
Aug 13, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate` header, we should not trigger the logic to ask the user for credentials and retry the request. This part is hinted at in a TODO / 'Needs testing' remark in the spec but needs to be fleshes out. Raised an upstream issue to do so: whatwg/fetch#1766 This fixes login forms triggering an infinite fetch loop when providing incorrect credentials.
gmta
added a commit
to gmta/ladybird
that referenced
this issue
Aug 13, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate` header, we should not trigger the logic to ask the user for credentials and retry the request. This part is hinted at in a TODO / 'Needs testing' remark in the spec but needs to be fleshed out. Raised an upstream issue to do so: whatwg/fetch#1766 This fixes login forms triggering an infinite fetch loop when providing incorrect credentials.
gmta
added a commit
to gmta/ladybird
that referenced
this issue
Aug 13, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate` header, we should not trigger the logic to ask the user for credentials and retry the request. This part is hinted at in a TODO / 'Needs testing' remark in the spec but needs to be fleshed out. Raised an upstream issue to do so: whatwg/fetch#1766 This fixes login forms triggering an infinite fetch loop when providing incorrect credentials. Co-Authored-By: Victor Tran <[email protected]>
tcl3
pushed a commit
to LadybirdBrowser/ladybird
that referenced
this issue
Aug 13, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate` header, we should not trigger the logic to ask the user for credentials and retry the request. This part is hinted at in a TODO / 'Needs testing' remark in the spec but needs to be fleshed out. Raised an upstream issue to do so: whatwg/fetch#1766 This fixes login forms triggering an infinite fetch loop when providing incorrect credentials. Co-Authored-By: Victor Tran <[email protected]>
nico
pushed a commit
to nico/serenity
that referenced
this issue
Nov 8, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate` header, we should not trigger the logic to ask the user for credentials and retry the request. This part is hinted at in a TODO / 'Needs testing' remark in the spec but needs to be fleshed out. Raised an upstream issue to do so: whatwg/fetch#1766 This fixes login forms triggering an infinite fetch loop when providing incorrect credentials. Co-Authored-By: Victor Tran <[email protected]> (cherry picked from commit e7984a77116d47fde150f81f6e18cae6aaa147ad)
nico
pushed a commit
to SerenityOS/serenity
that referenced
this issue
Nov 8, 2024
If a HTTP 401 response we get does not contain a `WWW-Authenticate` header, we should not trigger the logic to ask the user for credentials and retry the request. This part is hinted at in a TODO / 'Needs testing' remark in the spec but needs to be fleshed out. Raised an upstream issue to do so: whatwg/fetch#1766 This fixes login forms triggering an infinite fetch loop when providing incorrect credentials. Co-Authored-By: Victor Tran <[email protected]> (cherry picked from commit e7984a77116d47fde150f81f6e18cae6aaa147ad)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
needs concrete proposal
Moving the issue forward requires someone to figure out a detailed plan
topic: http
What is the issue with the Fetch Standard?
The current HTTP-network-or-cache fetch specification leaves checking the
WWW-Authenticate
header open for interpretation; ignoring it might trigger an infinite HTTP 401 loop re-asking a username and password to send with the new requests:fetch/fetch.bs
Lines 5873 to 5874 in 4cb3cf2
Similarly, HTTP 407 handling has outstanding
Proxy-Authenticate
header handling that needs to be specced:fetch/fetch.bs
Lines 5918 to 5919 in 4cb3cf2
The text was updated successfully, but these errors were encountered: