[ https://issues.apache.org/jira/brow...ls:all-tabpanel ]

Graham Dumpleton closed MODPYTHON-47.
-------------------------------------


> Digest Authorization header causes bad request error.
> -----------------------------------------------------
>
>                 Key: MODPYTHON-47
>                 URL: https://issues.apache.org/jira/browse/MODPYTHON-47
>             Project: mod_python
>          Issue Type: Bug
>          Components: publisher
>    Affects Versions: 3.1.4
>            Reporter: Graham Dumpleton
>         Assigned To: Graham Dumpleton
>            Priority: Minor
>             Fix For: 3.3
>
>         Attachments: MP47_20060307_grahamd_1.diff, MP47_20060309_grahamd_2
.diff
>
>
> If Apache is used to perform authentication, the Authorization header stil
l gets
> passed through to mod_python.publisher. Unfortunately, mod_python.publishe
r
> authentication code in process_auth() will attempt to decode the contents 
of the
> Authorization header even if there are no __auth__ or __access__ hooks def
ined
> for authentication and access control within the published code itself.
> The consequence of this is that if Digest authentication is used for AuthT
ype
> at level of Apache authentication, the process_auth() code will raise a ba
d request
> error as it assumes Authorization header is always in format for Basic aut
hentication
> type and when it can't decode it, it raises an error.
> What should happen is that any decoding of Authorization should only be do
ne
> if there is a __auth__ or __access__ hook that actually requires it. That 
way, if some
> one uses Digest authentication at Apache configuration file level, provide
d that no
> __auth__ or __access__ hooks are provided, there wouldn't be a problem.
> See:
>   http://www.modpython.org/pipermail/...ril/017911.html
>   http://www.modpython.org/pipermail/...ril/017912.html
> for additional information.

[ Post a follow-up to this message ]