Issue 979407: urllib2 digest auth totally broken (original) (raw)

Created on 2004-06-25 01:16 by aaronsw, last changed 2022-04-11 14:56 by admin. This issue is now closed.

Messages (6)
msg60522 - (view)	Author: Aaron Swartz (aaronsw)	Date: 2004-06-25 01:16
The urllib2 digest auth handler is totally broken. 1. It looks for an "Authorization" header instead of "WWW- Authenticate" (Authorization is the header you send back). 2. It thinks passwords in the URL are port names. 3. Even if you get around all that, it just doesn't work. It seems to encrypt the thing wrongly and get itself into an infinite loop sending the wrong answer back again and again, being rejected each time.
msg60523 - (view)	Author: Georg Brandl (georg.brandl) *	Date: 2006-02-20 21:00
Logged In: YES user_id=849994 For discussion about number 2 above, see #944396.
msg182136 - (view)	Author: Michele Orrù (maker) *	Date: 2013-02-15 09:47
Isn't this issue fixed and tested on Lib/test/test_urllib2.py:1304?
msg182154 - (view)	Author: Senthil Kumaran (orsenthil) *	Date: 2013-02-15 17:52
let me check that.
msg192438 - (view)	Author: Senko Rasic (senko) *	Date: 2013-07-06 13:13
Checked with 3.4.0 alpha, works fine. Apart from the tests mentioned, I used the following script to check digest auth: from urllib import request url = 'http://httpbin.org/digest-auth/auth/user/passwd' req = request.Request(url) password_manager = request.HTTPPasswordMgrWithDefaultRealm() password_manager.add_password(None, url, 'user', 'passwd') auth_manager = request.HTTPDigestAuthHandler(password_manager) opener = request.build_opener(auth_manager) request.install_opener(opener) handler = request.urlopen(req) assert handler.getcode() == 200
msg192564 - (view)	Author: Christian Heimes (christian.heimes) *	Date: 2013-07-07 14:40
The bug has been fixed a while ago. Python 2.7 as well as Python 3.x have tests to verify digest auth. Farewell Aaron...