Re: Handle HTTP error 511 Network Authentication Required (standard secure proxy authentification/captive portal detection)

From: Nicolas Mailhot <nicolas.mailhot@laposte.net>
Date: Feb 20, 2012, 18:27 UTC
Message-ID: <cb81840f853a1d43a7da03ea24c86445.squirrel@arekh.dyndns.org>
In-Reply-To: <20120220154452.GA27456@sigill.intra.peff.net>

Le Lun 20 février 2012 16:44, Jeff King a écrit :

Show 19 quoted lines

> In my experience, the captive portal process usually goes like this:
>
>   1. Connect to network.
>
>   2. Try some non-browser command. Wonder why in the world it isn't
>      working.
>
>   3. Open a browser and say "Ah, I see. A captive portal".
>
> The 511 proposal makes step 2 a lot better if the protocol is http[1].
> But it pretty much makes it better even without non-browser client
> support, because at least you will get a 511 error instead of having git
> complain that the remote repository is corrupted (which happens if the
> captive portal returns a redirect to an html page).
>
> We should already be doing that. Adding more support could make step 3 a
> little nicer, but like I said, I'd be more interested in seeing a real
> case first. It may even be a feature that would be more appropriate to
> curl (which git builds on for http access).

Step 3 is a quite less obvious on a corporate network, where Internet access is gated by a filtering proxy, that will let some sites pass transparently but require credentials to let you access others. Worst case, there are several load-balanced gateways on different physical sites (to avoid spofs in case of planes falling on the wrong place), that do not share authentication (because propagating auth across physical sites is hard). So no, just launching a browser is not sufficient to find the captive portal, you need to actually access the URL returned by error 511 in meta information. Git should at minimum report this URL.

(and no this is not an hypothetical scenario and yes there are git users trying to pass the gateways there)

-- 
Nicolas Mailhot