bugGNU Wget - Bugs: bug #20607, Authentication needs to match RFC...

 
 

bug #20607: Authentication needs to match RFC 2617

Submitted by:  Micah Cowan <micahcowan>
Submitted on:  Sat 28 Jul 2007 03:16:07 AM UTC  
 
Category: Protocol IssueSeverity: 5 - Blocker
Priority: 4Status: Confirmed
Privacy: PublicAssigned to: Micah Cowan <micahcowan>
Originator Name: Open/Closed: Open
Release: NoneOperating System: None
Reproducibility: NoneFixed Release: None
Planned Release: 1.14Regression: None
Work Required: 2 - WeeksPatch Included: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 28 Jul 2007 03:16:07 AM UTC, original submission:

From http://article.gmane.org/gmane.comp.web.wget.general/6861

HOW IT SHOULD WORK:

When "user:pass <at> " is specified, Wget should record that information, but
send nothing by default.

Once it receives a challenge, it should record the auth mechanism, realm
and protection-space information for the challenge, and feel free to
issue its response on all further URIs within the relevant protection
space (for the Basic mechanism, the protection space is the relevant URI
and all URIs deeper, and any URIs on the same host for which the server
issues a challenge with the same realm; for the Digest mechanism, the
protection space is either explicitly defined, or else consists of the
entire server).

In no event should the user:pass <at> information be sent in the Referer
header; ideally, it should be parsed out at the very beginning, recorded
as just described, and then removed from the URI before it is used any
further.

--user and --pass can then become essentially equivalent to prefixing
every command-line-specified URI with "user:pass <at> " information: it will
wait until challenged, and limit future authenticated responses to the
appropriate protection spaces (and, in particular, not automatically use
them for each and every request, regardless of host).

While we're on the subject, authentication info should be readable from
a file, and certainly from the terminal with local echo turned off. At
some point, users should be able to describe protection-spaces and
associate user/pass info with them.

Micah Cowan <micahcowan>In charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by micahcowan (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 11 Jun 2009 08:00:08 PM UTCmicahcowanPlanned Release1.12=>1.14
    Tue 04 Nov 2008 01:29:55 AM UTCmicahcowanPriority8=>4
    Mon 27 Aug 2007 05:16:54 PM UTCmicahcowanPriority7 - High=>8
    Wed 01 Aug 2007 04:31:34 AM UTCmicahcowanSeverity4 - Important=>5 - Blocker
      Priority5 - Normal=>7 - High
      StatusPostponed=>Confirmed

    Back to the top


    Powered by Savane 3.1-cleanup1