Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Spec WWW-Authenticate and Proxy-Authenticate handling in HTTP-network-or-cache fetch #1766

Open
gmta opened this issue Aug 13, 2024 · 0 comments
Open

Spec WWW-Authenticate and Proxy-Authenticate handling in HTTP-network-or-cache fetch #1766

gmta opened this issue Aug 13, 2024 · 0 comments
Labels
needs concrete proposal Moving the issue forward requires someone to figure out a detailed plan topic: http

Comments

@gmta
Copy link

gmta commented Aug 13, 2024

What is the issue with the Fetch Standard?

The current HTTP-network-or-cache fetch specification leaves checking the WWW-Authenticate header open for interpretation; ignoring it might trigger an infinite HTTP 401 loop re-asking a username and password to send with the new requests:

fetch/fetch.bs

Lines 5873 to 5874 in 4cb3cf2

<li class=XXX><p>Needs testing: multiple `<code>WWW-Authenticate</code>` headers, missing,
parsing issues.

Similarly, HTTP 407 handling has outstanding Proxy-Authenticate header handling that needs to be specced:

fetch/fetch.bs

Lines 5918 to 5919 in 4cb3cf2

<li class=XXX><p>Needs testing: multiple `<code>Proxy-Authenticate</code>` headers, missing,
parsing issues.

@annevk annevk added topic: http needs concrete proposal Moving the issue forward requires someone to figure out a detailed plan labels Aug 13, 2024
gmta added a commit to gmta/ladybird that referenced this issue Aug 13, 2024
@gmta
LibWeb: Ensure WWW-Authenticate header is present during fetch
a5848ac 
If the HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshes out. Raised an upstream issue to do so:

  whatwg/fetch#1766
gmta added a commit to gmta/ladybird that referenced this issue Aug 13, 2024
@gmta
LibWeb: Ensure WWW-Authenticate header is present during fetch
b3a848a 
If the HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshes out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.
gmta added a commit to gmta/ladybird that referenced this issue Aug 13, 2024
@gmta
LibWeb: Check presence of WWW-Authenticate header in fetch response
84f0e44 
If a HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshes out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.
@gmta gmta mentioned this issue Aug 13, 2024
Merged
gmta added a commit to gmta/ladybird that referenced this issue Aug 13, 2024
@gmta
LibWeb: Check presence of WWW-Authenticate header in fetch response
be14aa8 
If a HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshed out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.
gmta added a commit to gmta/ladybird that referenced this issue Aug 13, 2024
@gmta @vicr123
LibWeb: Check presence of WWW-Authenticate header in fetch response
46f36e0 
If a HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshed out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.

Co-Authored-By: Victor Tran <[email protected]>
tcl3 pushed a commit to LadybirdBrowser/ladybird that referenced this issue Aug 13, 2024
@gmta @vicr123 @tcl3
LibWeb: Check presence of WWW-Authenticate header in fetch response
e7984a7 
If a HTTP 401 response we get does not contain a `WWW-Authenticate`
header, we should not trigger the logic to ask the user for credentials
and retry the request.

This part is hinted at in a TODO / 'Needs testing' remark in the spec
but needs to be fleshed out. Raised an upstream issue to do so:

  whatwg/fetch#1766

This fixes login forms triggering an infinite fetch loop when providing
incorrect credentials.

Co-Authored-By: Victor Tran <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
needs concrete proposal Moving the issue forward requires someone to figure out a detailed plan topic: http
Milestone
No milestone
Development

No branches or pull requests
2 participants
@annevk @gmta