Rcurl: Http Authentication When Site Responds with Http 401 Code Without Www-Authenticate

RCurl: HTTP Authentication When Site Responds With HTTP 401 Code Without WWW-Authenticate

I've resolved the problem with the help of the author of RCurl, Duncan Lang. The solution is to explicitly set the httpauth option which sets the authentication method to try initially. This works:

getURL("https://api.picloud.com/job/?jids=12", userpwd="key:secret", httpauth = 1L) 

httpauth is a bitmask specifying which authentication methods to use. See the HTTP Authentication section of the libcurl tutorial for more details.

HTTP No Authorization field in the digest authentication requests

Apparently the problem was multi-line WWW-Authenticate header. You can see the "/r/n" separators between header field values in the screenshots(0x0d 0x0a bytes).

Such multi-line was allowed in the original RFC 2616 and then deprecated by the newer RFC 7230. See https://stackoverflow.com/a/31324422/8876135 for details and links.

After fixing the header field by making it single line the problem was gone. Still i have no idea why the exact same browsers had this issue with the header at some hosts but was completely fine at my work/home PC's.

Unauthorized (HTTP 401) R omdbapi

You have to get a key and add it to all your requests now.

OMDb API: http://www.omdbapi.com/?i=tt3896198&apikey=key
Poster API: http://img.omdbapi.com/?i=tt3896198&h=600&apikey=key

This is what they had on their site.

We are going private!

05/10/17 - New API Keys! Due to some security concerns on how the keys were being distributed I updated the form to email them and also changed the algorithm used, which means your older keys not obtained through email will eventually stop working. 

05/08/17 - Going Private! Please go read the post on the Patreon page about this major change. 

You have to get an API Key.

BasicAuth Prompt won't show with Status 401

This works although I am not sure why.

import tornado.ioloop
import tornado.web

class UserHandler(tornado.web.RequestHandler):
    def get(self, user_id):
        self.set_status(401)
        self.set_header('WWW-Authenticate', 'Basic realm=Users')

application = tornado.web.Application([
    (r"/users/(\w+)", UserHandler),
],debug=True)

if __name__ == "__main__":
    application.listen(8888)
    tornado.ioloop.IOLoop.instance().start()

Java socket Basic WWW-Authentication

I want to authenticate a socket connection in the Web browser

Basic access authentication does not authenticate a socket connection, but a HTTP request. There can be multiple HTTP requests inside a single underlying socket connection, with different or with no authentication. And requesting authentication and sending the authenticated request can be done in different connections.

   responseHeaders(200);

The status code when requesting authentication must be 401, not 200

   headers.add("WWW-Authenticate: Basic");

The WWW-Authenticate header must contain the realm attribute to show the user what the authentication is for.

For a short overview about the topic see Wikipedia: Basic access authentication: Server side. The ultimate reference is the standard though.

---

Related Topics