Don't ask user to authenticate if WWW-Authenticate header is not provided #357
Conversation
|
Hello! One or more of the commit messages in this PR do not match the Ladybird code submission policy, please check the |
vicr123
force-pushed
the
features/401-www-authenticate
branch
from
362627d to
f6c5560
Compare
|
You have edited a spec comment so that it doesn't match the spec anymore. (https://fetch.spec.whatwg.org/#concept-http-network-or-cache-fetch) Was that intended? |
| // 14. If response’s status is 401, httpRequest’s response tainting is not "cors", includeCredentials is true, | ||
| // and request’s window is an environment settings object, then: | ||
| // request’s window is an environment settings object, and there is a WWW-Authenticate header, then: |
There was a problem hiding this comment.
This comment is copied verbatim from the Fetch specification at https://fetch.spec.whatwg.org/#concept-http-network-or-cache-fetch
If this step in the spec is incorrect, please file a bug against https://github.com/whatwg/fetch
If we need to do something differently here (because the spec is wrong), we can add a separate comment, something like:
// FIXME: This isn't in the spec, but is actually required to avoid getting into a request loop.
// Spec bug: https://github.com/whatwg/fetch/issues/...
|
Agh, I didn't realise it was coped verbatim from the spec. Could this behaviour be part of 14.1? (Needs testing: WWW-Authenticate missing) |
Perhaps it could! I'm not sure. cc @Lubrsi, I think you've looked at this in the past? |
vicr123
force-pushed
the
features/401-www-authenticate
branch
from
f6c5560 to
a1051a3
Compare
If the WWW-Authenticate header is not provided, the authentication prompt is skipped
vicr123
force-pushed
the
features/401-www-authenticate
branch
from
a1051a3 to
ab2e508
Compare
|
Superseded by #1056 |
Currently, when a 401 response is received from the server, a routine is run that checks some items and attempts to re-issue a request with authentication headers. When this is returned to a call to
fetch()this makes Ladybird constantly reissue the same request over and over again.This PR ensures that the re-request logic is only engaged when the
WWW-Authenticateheader is present, allowing the client JS to handle a 401 from the server as needed.