Mailing-List: contact commons-httpclient-dev-help@jakarta.apache.org;
 run by ezmlm
Precedence: bulk
Reply-To: "Commons HttpClient Project"
 <commons-httpclient-dev@jakarta.apache.org>
Date: 9 Jun 2004 09:18:41 -0000
Message-ID: <20040609091841.9259.qmail@nagoya.betaversion.org>
From: bugzilla@apache.org
To: commons-httpclient-dev@jakarta.apache.org
Cc: 
Subject: DO NOT REPLY [Bug 29439]  -
    Credentials ignored if realm specified in preemptive authentication

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=29439>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=29439

Credentials ignored if realm specified in preemptive authentication


------- Additional Comments From pvdyck@operamail.com  2004-06-09 09:18 -------
Ortwin,

As long as preemptive auth is irrelevant without a null realm, a warning 
message is a solution.
But I don't personally think it is defensive enough since it disable preemptive 
auth and it could result in large performance degradation since you have to 
repeat (multi-megabytes?) POST requests two times to get through. 

It can even not work at all when you expect preemptive auth to work in a load 
balanced web server environment (load balancing is not configured to maintain 
sessions). 

What happens is that the first request goes to server 1 and answer is 401 (with 
a session id cookie) and then the second request goes to another server 2 who 
accepts the credentials BUT refuses the session id (answer is 401 invalid-
session id!).

It may sound tricky, but actually happens!

So, since preemptive auth without a null realm is useless, would it be possible 
to assume null realms if auth is preemtive in : Credentials creds = 
(Credentials) map.get(entry) ? Maybe using a Comparable interface on 
Credentials objects ?
 
And BTW, thanks for you quick and efficient support,

Philippe

---------------------------------------------------------------------
To unsubscribe, e-mail: commons-httpclient-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-httpclient-dev-help@jakarta.apache.org