You are viewing a plain text version of this content. The canonical link for it is here.
Posted to httpclient-users@hc.apache.org by "Romstorfer, Georg" <Ge...@cryptas.com> on 2016/01/20 10:41:42 UTC
CachingHttpClient and IIS Digest authentication
I tried to do Digest authentication with the CachingHttpClient against an IIS 7 Webserver, but the client enters an infinite loop because the server always responds with the parameter "stale=true" in the WWW-Authenticate header.
I did some debugging and found out, that the cause is the Via header added by the CachingHttpClient. So now I can also reproduce it with the not caching HttpClient when I simply add the Via header to the request.
Is this behaviour conforming to any standards, a bug in IIS 7 or a bug in the CachingHttpClient?
I'm using httpclient-4.5.1
Re: CachingHttpClient and IIS Digest authentication
Posted by Gary Gregory <ga...@gmail.com>.
Is it reasonable to hang this way though? Should we have a timeout or retry
count and then throw an exception?
Gary
On Jan 20, 2016 6:06 AM, "Oleg Kalnichevski" <ol...@apache.org> wrote:
> On Wed, 2016-01-20 at 09:41 +0000, Romstorfer, Georg wrote:
> > I tried to do Digest authentication with the CachingHttpClient against
> an IIS 7 Webserver, but the client enters an infinite loop because the
> server always responds with the parameter "stale=true" in the
> WWW-Authenticate header.
> > I did some debugging and found out, that the cause is the Via header
> added by the CachingHttpClient. So now I can also reproduce it with the not
> caching HttpClient when I simply add the Via header to the request.
> >
> > Is this behaviour conforming to any standards, a bug in IIS 7 or a bug
> in the CachingHttpClient?
> >
> > I'm using httpclient-4.5.1
>
> Without re-reading RFC 2617 this looks like a server side issue to me.
> By responding with 'stale=true' the server effectively asks the client
> to re-authenticate using a newer 'nonce' value.
>
> Oleg
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
> For additional commands, e-mail: httpclient-users-help@hc.apache.org
>
>
Re: CachingHttpClient and IIS Digest authentication
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Wed, 2016-01-20 at 09:41 +0000, Romstorfer, Georg wrote:
> I tried to do Digest authentication with the CachingHttpClient against an IIS 7 Webserver, but the client enters an infinite loop because the server always responds with the parameter "stale=true" in the WWW-Authenticate header.
> I did some debugging and found out, that the cause is the Via header added by the CachingHttpClient. So now I can also reproduce it with the not caching HttpClient when I simply add the Via header to the request.
>
> Is this behaviour conforming to any standards, a bug in IIS 7 or a bug in the CachingHttpClient?
>
> I'm using httpclient-4.5.1
Without re-reading RFC 2617 this looks like a server side issue to me.
By responding with 'stale=true' the server effectively asks the client
to re-authenticate using a newer 'nonce' value.
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org