kio_http: HTTP body of 401 response not shown when SPNEGO authentication fails
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
kdelibs |
New
|
Medium
|
|||
kde4libs (Ubuntu) |
New
|
Undecided
|
Unassigned |
Bug Description
If an HTTP server responds with the "401 Unauthorized" status code and requests SPNEGO authentication with the response-header line "WWW-Authenticate: Negotiate", but kio_http fails to respond to the challenge, Konqueror shows a built-in error page saying "Authorization failed". Instead I'd expect to see the entity body of the server's 401 response.
The server I'm requesting actually sends an HTML page with a login form, but also allows for SPNEGO authentication (RFC 4559). Therefore it sends the login page with the "401 Unauthorized" status code and the response-header line "WWW-Authenticate: Negotiate". If the client can respond with appropriate authentication data, it will retry the HTTP request with an "Authorization" header. But if it cannot, it should show the entity body of the server's 401 response to the user so that he can manually log in. (I might be wrong, but this is my understanding of RFC 2616, section 10.4, "Client Error 4xx", where it says "User agents SHOULD display any included entity to the user." And that is what at least Firefox and probably other browsers currently do.)
However, if kio_http cannot respond to the server's SPNEGO request, it displays a built-in error page. So, Konqueror does not show the server's login form and the user cannot log in manually.
Reproduced on
- kubuntu trusty (14.04) with kdelibs5-plugins 4:4.13.3-0ubuntu0.1 and
- kubuntu utopic (14.10) with kdelibs5-plugins 4:4.14.1-0ubuntu1.
It took me a while to understand how this works, but now the fix appears to be quite simple. In certain places where kio_http detects an error, it calls sendErrorPageNo
As a patch (see attachment) to source package kde4libs-4.14.1 I added such check to kioslave/
tags: | added: kubuntu spnego |
Changed in kdelibs: | |
importance: | Unknown → Medium |
status: | Unknown → New |
The attachment "kde4libs- 4.14.1- show-body- after-failed- auth.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.
[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]