Auth problem with publisher handler and Opera browser?

["Michael A. Josephson" <mi...@josephson.org>]

Hi,

I'm not sure if this is something that should be fixed in modpython's
publisher handler and/or if it should be reported as a bug in Opera.

Using the version of the publisher handler that's included with
mod_python-2.7.8, if I set a script to require authentication (by
assigning a userlist to __auth__) then Opera (6.x and 7.x) gives "The
server requested a login authentication method that is not supported" when
you call the script.

I think this is caused by publisher.py putting spaces between the equals
character and the value of the realm attribute on the WWW-Authenticate
header.

e.g. at the moment, publisher sends:

WWW-Authenticate: Basic realm = "MyApp"

If I edit publisher.py to output:

WWW-Authenticate: Basic realm="MyApp"

this resolves the problem.

-Michael

Re: Auth problem with publisher handler and Opera browser?

[Ian Clelland <ia...@veryfresh.com>]

On Sun, Apr 06, 2003 at 04:35:04PM -0400, Gregory (Grisha) Trubetskoy wrote:
> Yes, the latest mod_python publisher doesn't have the space and there is a
> comment in the code specifically mentioning Opera.
> 
> I guess the simple fix is to edit the publisher and take out the space....
> 
> Grisha
> 
> On Sun, 6 Apr 2003, Michael A. Josephson wrote:
[snip]
> > e.g. at the moment, publisher sends:
> >
> > WWW-Authenticate: Basic realm = "MyApp"
> >
> > If I edit publisher.py to output:
> >
> > WWW-Authenticate: Basic realm="MyApp"
> >
> > this resolves the problem.

This issue has come up on the mailing list before; I mentioned at the
time that it is really a problem with the Opera browser: HTTP allows
whitespace nearly anywhere, but especially around things like "="
characters (see RFC2616, S2.1).

I think that the patch was added to the Publisher code to be nice to
Opera, but it was never really a bug in the first place :)

Old references:
  http://www.modpython.org/pipermail/mod_python/2002-August/002414.html
  http://www.modpython.org/pipermail/mod_python/2002-August/002421.html


Ian Clelland
<ia...@veryfresh.com>

Re: Auth problem with publisher handler and Opera browser?

["Gregory (Grisha) Trubetskoy" <gr...@apache.org>]

Yes, the latest mod_python publisher doesn't have the space and there is a
comment in the code specifically mentioning Opera.

I guess the simple fix is to edit the publisher and take out the space....

Grisha

On Sun, 6 Apr 2003, Michael A. Josephson wrote:

> Hi,
>
> I'm not sure if this is something that should be fixed in modpython's
> publisher handler and/or if it should be reported as a bug in Opera.
>
> Using the version of the publisher handler that's included with
> mod_python-2.7.8, if I set a script to require authentication (by
> assigning a userlist to __auth__) then Opera (6.x and 7.x) gives "The
> server requested a login authentication method that is not supported" when
> you call the script.
>
> I think this is caused by publisher.py putting spaces between the equals
> character and the value of the realm attribute on the WWW-Authenticate
> header.
>
> e.g. at the moment, publisher sends:
>
> WWW-Authenticate: Basic realm = "MyApp"
>
> If I edit publisher.py to output:
>
> WWW-Authenticate: Basic realm="MyApp"
>
> this resolves the problem.
>
> -Michael
>