DO NOT REPLY [Bug 15571] New: - No WWW-Authenticate header returned in 401 message

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=15571>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=15571

No WWW-Authenticate header returned in 401 message

           Summary: No WWW-Authenticate header returned in 401 message
           Product: Apache httpd-2.0
           Version: 2.0.40
          Platform: Other
        OS/Version: Other
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: mod_auth
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: christ@aw.sgi.com


Overview Description:

No WWW-Authenticate header is returned when access to a URI indicated in 
the "Destination:" header of a request fails authentication.

Steps to Reproduce:

1. Try copying a file from a normal area to a password-protected area without 
supplying any authentication information (I used http://test.webdav.org/dav as 
my normal area, and http://test.webdav.org/auth-basic as my password-protected 
area).

Note: "normal area" refers to an area not requiring authorization.

Actual Results:

The copy failed and a "401 Unauthorized" message was returned from the server.  
However, the "401 Unauthorized" message did not contain a "WWW-Authenticate" 
header as the HTTP/1.1 specs mention it should.

Expected Results:

The copy should fail and a "401 Unauthorized" message should be returned from 
the server containing a "WWW-Authenticate" header.  The HTTP/1.1 specs mention 
that this header *must* be included in a 401 response.

Build Date & Platform:

Apache/2.0.41-dev (Unix) DAV/2 SVN/0.14.2 (dev build)
The server is running the mod_dav and mod_dav_fs modules.

Additional Builds and Platforms:

It has been mentioned that this problem occurs with Apache 1.3/mod_dav 1.0.

Additional Information:

This also occurs on a MOVE (or any request with a "Destination" URI requiring 
Authorization).

>From the dav-dev mailing list:
"...the 401 is being generated in an Apache "subrequest", but the WWW-Auth
header is not being promoted to the "real" request, so it gets lost..."

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org