git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Handle HTTP error 511 Network Authentication Required (standard secure proxy authentification/captive portal detection)

From
Jeff King <peff@peff.net>
Date
Feb 20, 2012, 01:06 UTC
Message-ID
<20120220010617.GB4140@sigill.intra.peff.net>
In-Reply-To
<4b8f33ba4c870528a82ab85d6dad68bd.squirrel@arekh.dyndns.org>
On Sun, Feb 19, 2012 at 10:03:37PM +0100, Nicolas Mailhot wrote:
Show 11 quoted lines
> The IETF finally set up to fix this problem and defined a standard HTTP error
> that lets access control equipments tell the web client authentication or
> re-authentication is needed and where the authentication form is located.
> 
> http://tools.ietf.org/id/draft-nottingham-http-new-status-04.txt
> 
> → <http://www.rfc-editor.org/queue2.html#draft-nottingham-http-new-status> (the
> spec is approved and in the queue for publication as RFC)
> 
> Please add error 511 handling in git, so git users that try to access external
> git repositories over http can authenticate on the corporate proxy
If I'm reading this right, the process works something like this:
  1. Git wants to make a request to http://example.com
  2. We make our request to a proxy server which is transparently
     proxying our traffic (i.e, a "captive portal").
  3. The proxy returns 511 along with some URL (e.g.,
     "http://login.corporatenetwork"), indicating that we need
     to go to that URL to complete some authentication.

As a non-browser client, what should git do? We can't make sense of the content at http://login.corporatenetwork, which is most likely an HTML form asking for credentials (or even money, if the captive portal is something like a public wireless provider). The best we can probably do is die and say "apparently you need to go http://login.corporatenetwork in a browser before making your request".

Reading that rfc draft, the man impetus for non-browser clients seems not to get them to do anything useful, but rather to return them a code that is clearly not from the actual site (if it were a redirect, for example, then we would think that example.com is redirecting is, which is simply not true).

-Peff
Previous: Nicolas MailhotNext: Nicolas Mailhot
Message 2 of 14 in “Handle HTTP error 511 Network Authentication Required (standard secure proxy authentification/captive portal detection)”
  1. Nicolas MailhotFeb 19, 2012
  2. Jeff KingFeb 20, 2012
  3. Nicolas MailhotFeb 20, 2012
  4. Jeff KingFeb 20, 2012
  5. Nicolas MailhotFeb 20, 2012
  6. Jeff KingFeb 20, 2012
  7. Nicolas MailhotFeb 20, 2012
  8. Jeff KingFeb 20, 2012
  9. Nicolas MailhotFeb 20, 2012
  10. Jeff KingFeb 20, 2012
  11. Nicolas MailhotFeb 20, 2012
  12. Daniel StenbergFeb 20, 2012
  13. Jeff KingFeb 20, 2012
  14. Junio C HamanoFeb 20, 2012

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.