git/list[1] front-page[2] threads[3] people[4] search[5] about
 

HTTP error 511 [Was: Secure (https) proxy authentification]

From
NMNicolas Mailhot <nicolas.mailhot@laposte.net>
Date
Feb 21, 2012, 08:58 UTC
Message-ID
<39d91a07ae0beb19a734e52496ab5700.squirrel@arekh.dyndns.org>
In-Reply-To
<4ec05cf797322715a960743aeec0a48b.squirrel@arekh.dyndns.org>
Le Dim 19 février 2012 11:22, Nicolas Mailhot a écrit :
> 511 is exactly what I need. I was not aware of it. Is it simplemented in any
> browser yet? Where should I point the browser writers to get it implemented?
>
> http://tools.ietf.org/id/draft-nottingham-http-new-status-04.txt ?

I take that back. 511 is almost exactly what we need. However, when I pointed the authors of some of the tools that pass through our proxy to it (curl, git) they told me they could not parse html code in their tools, so they really need a location (or similar) field containing the address of the authentication portal to communicate it to the user. Without this field, they can only stop with 'Network authentication is needed' instead of 'Please open <url> in your browser to proceed'.

http://article.gmane.org/gmane.comp.version-control.git/191085 http://article.gmane.org/gmane.comp.version-control.git/191087 http://article.gmane.org/gmane.comp.version-control.git/191086

(the nearest thing there is in the spec is the url in meta, but it's only in the example, not mandatory, and no one will write code for something they can not be sure will exist)

We'd like to support those tools properly as their users' previous clumsy attempts to navigate our current non-standard redirection method resulted in internal security investigations.

It is a problem in our setup as we only block some URLs (others are allowed transparently without auth), and we use several proxy farms in different physical sites (to avoid spofs). So just opening any url in a browser won't trigger an authentication request (the url may not be blocked, or the browser may pass through a gateway where the user IP is already authorized, while git/etc tried to access through another one).

Could you please revise the error 511 definition to add such a field ?
Regards,
-- 
Nicolas Mailhot
Next: Julian Reschke
Message 1 of 3 in “HTTP error 511 [Was: Secure (https) proxy authentification]”
  1. Nicolas MailhotFeb 21, 2012
  2. Julian ReschkeFeb 21, 2012
  3. Nicolas MailhotFeb 21, 2012

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.