{"thread":{"id":"29679","subject":"HTTP error 511 [Was: Secure (https) proxy authentification]","startedAt":"2012-02-21T08:58:16Z","lastAt":"2012-02-21T09:44:45Z","messageCount":3,"participants":["Nicolas Mailhot","Julian Reschke"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"185061","messageId":"39d91a07ae0beb19a734e52496ab5700.squirrel@arekh.dyndns.org","threadId":"29679","inReplyTo":"4ec05cf797322715a960743aeec0a48b.squirrel@arekh.dyndns.org","subject":"HTTP error 511 [Was: Secure (https) proxy authentification]","fromName":"Nicolas Mailhot","fromEmail":"nicolas.mailhot@laposte.net","sentAt":"2012-02-21T08:58:16Z","receivedAt":"2012-02-21T08:58:16Z","isPatch":false,"sender":{"key":"nicolas.mailhot@laposte.net","avatar":null},"body":"\nLe Dim 19 février 2012 11:22, Nicolas Mailhot a écrit :\n\n> 511 is exactly what I need. I was not aware of it. Is it simplemented in any\n> browser yet? Where should I point the browser writers to get it implemented?\n>\n> http://tools.ietf.org/id/draft-nottingham-http-new-status-04.txt ?\n\nI take that back. 511 is almost exactly what we need. However, when I pointed\nthe authors of some of the tools that pass through our proxy to it (curl, git)\nthey told me they could not parse html code in their tools, so they really\nneed a location (or similar) field containing the address of the\nauthentication portal to communicate it to the user. Without this field, they\ncan only stop with 'Network authentication is needed' instead of 'Please open\n<url> in your browser to proceed'.\n\nhttp://article.gmane.org/gmane.comp.version-control.git/191085\nhttp://article.gmane.org/gmane.comp.version-control.git/191087\nhttp://article.gmane.org/gmane.comp.version-control.git/191086\n\n(the nearest thing there is in the spec is the url in meta, but it's only in\nthe example, not mandatory, and no one will write code for something they can\nnot be sure will exist)\n\nWe'd like to support those tools properly as their users' previous clumsy\nattempts to navigate our current non-standard redirection method resulted in\ninternal security investigations.\n\nIt is a problem in our setup as we only block some URLs (others are allowed\ntransparently without auth), and we use several proxy farms in different\nphysical sites (to avoid spofs). So just opening any url in a browser won't\ntrigger an authentication request (the url may not be blocked, or the browser\nmay pass through a gateway where the user IP is already authorized, while\ngit/etc tried to access through another one).\n\nCould you please revise the error 511 definition to add such a field ?\n\nRegards,\n\n-- \nNicolas Mailhot\n"},{"id":"185066","messageId":"4F4363C1.90902@gmx.de","threadId":"29679","inReplyTo":"39d91a07ae0beb19a734e52496ab5700.squirrel@arekh.dyndns.org","subject":"Re: HTTP error 511 [Was: Secure (https) proxy authentification]","fromName":"Julian Reschke","fromEmail":"julian.reschke@gmx.de","sentAt":"2012-02-21T09:28:33Z","receivedAt":"2012-02-21T09:28:33Z","isPatch":false,"sender":{"key":"julian.reschke@gmx.de","avatar":null},"body":"On 2012-02-21 09:58, Nicolas Mailhot wrote:\n>\n> Le Dim 19 février 2012 11:22, Nicolas Mailhot a écrit :\n>\n>> 511 is exactly what I need. I was not aware of it. Is it simplemented in any\n>> browser yet? Where should I point the browser writers to get it implemented?\n>>\n>> http://tools.ietf.org/id/draft-nottingham-http-new-status-04.txt ?\n>\n> I take that back. 511 is almost exactly what we need. However, when I pointed\n> the authors of some of the tools that pass through our proxy to it (curl, git)\n> they told me they could not parse html code in their tools, so they really\n> need a location (or similar) field containing the address of the\n> authentication portal to communicate it to the user. Without this field, they\n> can only stop with 'Network authentication is needed' instead of 'Please open\n> <url>  in your browser to proceed'.\n\nYes. The definition of status code 511 did not attempt to solve more \nproblems than that.\n\n> http://article.gmane.org/gmane.comp.version-control.git/191085\n> http://article.gmane.org/gmane.comp.version-control.git/191087\n> http://article.gmane.org/gmane.comp.version-control.git/191086\n>\n> (the nearest thing there is in the spec is the url in meta, but it's only in\n> the example, not mandatory, and no one will write code for something they can\n> not be sure will exist)\n>\n> We'd like to support those tools properly as their users' previous clumsy\n> attempts to navigate our current non-standard redirection method resulted in\n> internal security investigations.\n>\n> It is a problem in our setup as we only block some URLs (others are allowed\n> transparently without auth), and we use several proxy farms in different\n> physical sites (to avoid spofs). So just opening any url in a browser won't\n> trigger an authentication request (the url may not be blocked, or the browser\n> may pass through a gateway where the user IP is already authorized, while\n> git/etc tried to access through another one).\n>\n> Could you please revise the error 511 definition to add such a field ?\n\nThe specification has already been approved, so it's too late to make \nmore than editorial changes.\n\nBest regards, Julian\n"},{"id":"185067","messageId":"f5ee5676efa057beb51b00237a6c13b2.squirrel@arekh.dyndns.org","threadId":"29679","inReplyTo":"4F4363C1.90902@gmx.de","subject":"Re: HTTP error 511 [Was: Secure (https) proxy authentification]","fromName":"Nicolas Mailhot","fromEmail":"nicolas.mailhot@laposte.net","sentAt":"2012-02-21T09:44:45Z","receivedAt":"2012-02-21T09:44:45Z","isPatch":false,"sender":{"key":"nicolas.mailhot@laposte.net","avatar":null},"body":"\nLe Mar 21 février 2012 10:28, Julian Reschke a écrit :\n> On 2012-02-21 09:58, Nicolas Mailhot wrote:\n\n>> Could you please revise the error 511 definition to add such a field ?\n>\n> The specification has already been approved, so it's too late to make\n> more than editorial changes.\n\nI know it has been approved, and we'll go with it as is for now on our network.\nHowever, could it be extended to add this location field later please? (taking\ninto account the tool authors' feedback)\n\nBest regards,\n\n-- \nNicolas Mailhot\n"}]}