bugGNU Wget - Bugs: bug #20607, Authentication needs to match RFC...

 
 

bug #20607: Authentication needs to match RFC 2617

Submitter:  Micah Cowan <micahcowan>
Submitted:  Sat 28 Jul 2007 03:16:07 AM UTC
   
 
Category:  Protocol Issue Severity:  5 - Blocker
Priority:  4 Status:  Confirmed
Privacy:  Public Assigned to:  micahcowan
Originator Name:  Open/Closed:  Open
Release:  None Operating System:  None
Reproducibility:  None Fixed Release:  None
Planned Release:  1.14 Regression:  None
Work Required:  2 - Weeks Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 28 Jul 2007 03:16:07 AM UTC, original submission:  

From http://article.gmane.org/gmane.comp.web.wget.general/6861

HOW IT SHOULD WORK:

When "user:pass <at> " is specified, Wget should record that information, but
send nothing by default.

Once it receives a challenge, it should record the auth mechanism, realm
and protection-space information for the challenge, and feel free to
issue its response on all further URIs within the relevant protection
space (for the Basic mechanism, the protection space is the relevant URI
and all URIs deeper, and any URIs on the same host for which the server
issues a challenge with the same realm; for the Digest mechanism, the
protection space is either explicitly defined, or else consists of the
entire server).

In no event should the user:pass <at>  information be sent in the Referer
header; ideally, it should be parsed out at the very beginning, recorded
as just described, and then removed from the URI before it is used any
further.

--user and --pass can then become essentially equivalent to prefixing
every command-line-specified URI with "user:pass <at> " information: it will
wait until challenged, and limit future authenticated responses to the
appropriate protection spaces (and, in particular, not automatically use
them for each and every request, regardless of host).

While we're on the subject, authentication info should be readable from
a file, and certainly from the terminal with local echo turned off. At
some point, users should be able to describe protection-spaces and
associate user/pass info with them.

Micah Cowan <micahcowan>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by micahcowan (Submitted the item)
  •  

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-06-11 micahcowan Planned Release1.12 1.14
    2008-11-04 micahcowan Priority8 4
    2007-08-27 micahcowan Priority7 - High 8
    2007-08-01 micahcowan Severity4 - Important 5 - Blocker
        Priority5 - Normal 7 - High
        StatusPostponed Confirmed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code