Re: Default authentication over https?
- From
Jeff King <peff@peff.net>
- Date
- Apr 15, 2016, 22:43 UTC
- Message-ID
- <20160415224334.GA32160@sigill.intra.peff.net>
- In-Reply-To
- <20160415222120.GA24777@sigill.intra.peff.net>
On Fri, Apr 15, 2016 at 06:21:20PM -0400, Jeff King wrote:
Show 8 quoted lines
> I think we can take that down to _two_ requests pretty easily. We know > in the very first request that the server told us something like: > > < WWW-Authenticate: Basic realm="GitHub" > > but curl doesn't remember that. However, we should be able to pull it > out of the old request and feed it into the new one. That would save the > second request, which is just a probe.
Hmm. Looks like we already pull this out of the curl result for other reasons, but we never feed it back in to the next request. So if I do this:
diff --git a/http.c b/http.c index 9bedad7..add9bf2 100644 --- a/http.c +++ b/http.c @@ -1132,6 +1132,8 @@ static int handle_curl_result(struct slot_results *results) return HTTP_NOAUTH; } else { #ifdef LIBCURL_CAN_HANDLE_AUTH_ANY + if (results->auth_avail) + http_auth_methods = results->auth_avail; http_auth_methods &= ~CURLAUTH_GSSNEGOTIATE; #endif return HTTP_REAUTH; that drops my test case down to two requests: once to find out that we need auth via the 401, and then we feed curl sufficient information to do the followup in a single request (the GSSNEGOTIATE thing there is a hack from 4dbe664, which we can ignore for now). Interestingly, curl _does_ reuse the connection this time. I'm still not sure why it didn't in the original case. But this means the whole thing is happening over a single TCP session, which is good (and I didn't have to change my config at all). -Peff