bugGNU Wget - Bugs: bug #42898, Authentication within URL -...

 
 

bug #42898: Authentication within URL - basic_authed_hosts not updated

Submitter:  Mein Name <eldnumh>
Submitted:  Fri 01 Aug 2014 11:13:27 AM UTC
   
 
Category:  Program Logic Severity:  3 - Normal
Priority:  5 - Normal Status:  Invalid
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  None Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  None Regression:  Yes
Work Required:  None Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 01 Sep 2014 01:16:23 PM UTC, comment #2: 

Hi,

the web server I try to use is located on a power strip, which can be toggle via network (http://www.leunig.de/files/eps_8mplus_r2_datasheet_2011_02.pdf). So I am not surprised, that the server does not follow the specification.

Thanks for you explanation. This bug can be closed from my point of view.

Mein Name <eldnumh>
Mon 01 Sep 2014 08:49:23 AM UTC, comment #1: 

Hi,

Thanks for your bug report. However, the issue you describe is there by design and is not considered a flaw.

When you put the username and password in the URL, Wget assumes that those credentials are valid for the particular file alone and not everything else on the server. This is the reason why Wget has an explicit check to see if the credentials were provided in the URL itself. In that scenario, we do not store the credentials globally and the server is not appended to basic_authed_hosts.

The issue in fact occurs due to a mis-configured server on your end. I came to this conclusion based on the debug logs that you provided. Let me explain further:

I'm going to use the problematic log, Wget_log_withPasswordInUrl.txt. In this log file, Wget first sends a normal HTTP GET request to the server, with a "Connection: Keep-Alive" Header. The response to the request is a 401 Authorization Required with no "Connection" header. Hence, Wget assumes a persistent connection and continues. This behavior of Wget is based on RFC 7230 sec. 6.1 and the erstwhile specification RFC 2616 too, which states, 'A server that does not support persistent connections MUST send the "close" connection option in every response message that does not have a 1xx Informational) status code.'

When Wget realizes that the connection was closed, it attempts to start a new connection. But by this time all the previous state information in Wget has been lost. It initiates a new connection and goes through the dance again. However, if the server were to simply send a "Connection: Close" header as is mentioned in the HTTP Specification, Wget would store the details and ensure that the authorization header is indeed sent even when it needs to open a new connection.

If you have any more issues / need more information about this issue, please do not hesitate to ask. However, I don't think we'll be changing how Wget functions based on this bug report.

Darshit Shah <darnir>
Group administrator
Fri 01 Aug 2014 11:13:27 AM UTC, original submission:  

I am used to put the password into the URL of an wget call, using it with version 1.9.1 worked well.

But with version 1.15 it retries to access the page repeatingly without success.

When using the --user and --password parameter, wget gets the content as expected.

Turning on debugging shows, that in the later case, that basic_authed_hosts is updated:
Inserted ‘192.168.18.102’ into basic_authed_hosts

After that, the Authorization is resent with each request.

For me it looks like a bug, that with URL authorization, wget sends requests without Authorization part.

Here are my wget calls:
failing:
wget -O /dev/null -t 2 -d http://epsgats8:gats8@192.168.18.102:80/hidden.htm
succeeding:
wget -O /dev/null -t 2 -d --user=epsgats8 --password=gats8 http://192.168.18.102:80/hidden.htm

Find attached the debug log from 1.15 as well as 1.9.1. I try to update the wireshark logs as well.

Mein Name <eldnumh>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by darnir (Posted a comment)
  • -email is unavailable- added by eldnumh (Submitted the item)
  •  

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-09-01 darnir StatusNone Invalid
        Open/ClosedOpen Closed
    2014-08-01 eldnumh Attached File- Added wget_log_withPasswordInUrl.pcapng.gz, #31821
    2014-08-01 eldnumh Attached File- Added wget_log_withPasswordOption.txt, #31817
        Attached File- Added wget_log_withPasswordOption.pcapng.gz, #31818
        Attached File- Added wget_log_withPasswordInUrl.txt, #31819
        Attached File- Added wget_1.9.1_log_withPasswordInUrl.txt, #31820

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code