git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 0/2] http: allow multi-pass authentication

From
Martin Storsjö <martin@martin.st>
Date
Dec 1, 2009, 10:28 UTC
Message-ID
<alpine.DEB.2.00.0912011208160.5582@cone.home.martin.st>
In-Reply-To
<20091127234110.7b7e9993.rctay89@gmail.com>
On Fri, 27 Nov 2009, Tay Ray Chuan wrote:
> This patch series applies on top of master. It enables fetching and
> pushing over http with the most suitable authentication scheme chosen
> by curl when the http.authAny or GIT_HTTP_AUTH_ANY is set.
I also tested this, and things generally seem to work fine.

Thanks to the "maintain curl sessions" patch, only the first request needs to be redone after getting the 401 error containing the authentication challenge, the later ones work fine on the first try. However, theoretically, I guess we can't be certain that the curl session really is initialized for the later requests (we could be given a new fresh curl session for some reason), or the first request could perhaps be a large, (currently) non-rewindable POST.

Avoiding redoing large POST requests is generally accomplished by adding a 
Expect: 100-continue header, and then waiting for a reply (either 100 
continue or 401 unauthorized) to that header before actually sending the 
POST body data. If the server doesn't support the Expect header (e.g. 
Lighttpd doesn't support it), the client starts sending the POST body 
after a timeout (1 second in libcurl).

(As a side note, chunked POST requests without a content-length header isn't supported by lighttpd at all at the moment, neither in the stable 1.4 version nor in the new upcoming 1.5 branch.)

Normally, libcurl should add the Expect: 100-continue header automatically, but for some reason (http://article.gmane.org/gmane.comp.web.curl.library/25992) it doesn't, so that's probably why we're manually adding that header in remote-curl.c:371 at the moment. libcurl doesn't detect this at the moment (http://article.gmane.org/gmane.comp.web.curl.library/25991) so it won't wait for the 100 continue response before starting to send the body data.

So, with a server supporting Expect, the 401 error response may come after sending a few KB of POST data (corresponding to the roundtrip delay for the server to respond to the header) - if the server doesn't support Expect at all, the whole request will be sent and may need to be rewound.

To clarify - this only happens if the curl authentication isn't initialized yet, for the first request of every curl session. The "maintain curl sessions" patch makes sure this isn't needed in the normal case.

I've experimented with two solutions to this, which add partial and full rewind solutions to the chunked POST requests - I'll send them as follow-ups to this mail.

// Martin
Previous: Tay Ray ChuanNext: Martin Storsjö
Message 5 of 22 in “Add an option for using any HTTP authentication scheme, not only basic”
  1. Add an option for using any HTTP authentication scheme, not only basicMartin Storsjö, Apr 14, 2009
  2. 0/2 http: allow multi-pass authenticationTay Ray Chuan, Nov 27, 2009
  3. 1/2 http: maintain curl sessionsTay Ray Chuan, Nov 27, 2009
  4. 2/2 Add an option for using any HTTP authentication scheme, not only basicTay Ray Chuan, Nov 27, 2009
  5. Martin StorsjöDec 1, 2009
  6. Allow curl to rewind the RPC read bufferMartin Storsjö, Dec 1, 2009
  7. Shawn O. PearceDec 1, 2009
  8. Tay Ray ChuanDec 1, 2009
  9. Shawn O. PearceDec 1, 2009
  10. Martin StorsjöDec 1, 2009
  11. Junio C HamanoDec 1, 2009
  12. Tay Ray ChuanDec 2, 2009
  13. Martin StorsjöDec 2, 2009
  14. Allow curl to rewind the RPC read buffer at any timeMartin Storsjö, Dec 1, 2009
  15. Shawn O. PearceDec 1, 2009
  16. Martin StorsjöDec 1, 2009
  17. Tay Ray ChuanDec 2, 2009
  18. Daniel StenbergDec 1, 2009
  19. Tay Ray ChuanDec 2, 2009
  20. Daniel StenbergDec 2, 2009
  21. Martin StorsjöDec 2, 2009
  22. Daniel StenbergDec 2, 2009

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.