Repository navigation
urllib: Support for multiple WWW-Authenticate headers and/or multiple challenges per header #59515
Description
| BPO | 15310 |
|---|---|
| Nosy | @mdickinson, @orsenthil |
| Files |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = 'https://github.com/orsenthil'
closed_at = None
created_at = <Date 2012-07-09.22:40:48.971>
labels = ['type-bug', 'library']
title = 'urllib: Support for multiple WWW-Authenticate headers and/or multiple challenges per header'
updated_at = <Date 2013-09-02.14:45:06.162>
user = 'https://bugs.python.org/almost'bugs.python.org fields:
activity = <Date 2013-09-02.14:45:06.162>
actor = 'Sigmund.Augdal'
assignee = 'orsenthil'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2012-07-09.22:40:48.971>
creator = 'almost'
dependencies = []
files = ['26337']
hgrepos = []
issue_num = 15310
keywords = ['patch']
message_count = 3.0
messages = ['165132', '165133', '196782']
nosy_count = 4.0
nosy_names = ['mark.dickinson', 'orsenthil', 'almost', 'Sigmund.Augdal']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue15310'
versions = ['Python 3.4']Linked PRs
Metadata
Metadata
Assignees
Projects
- Status
Activity
almost commentedon Jul 9, 2012
The HTTP spec specifies that the 401 (Unauthorized) response can be accompanied by multiple challenges, either as separate WWW-Authenticate headers or in a single WWW-Authenticate header separated by commas. The client should always pick the strongest supported which in the case of urllib is "digest". Unknown challenge types (for urllib that's anything but "basic" and "digest") should be ignored as long as there is a known one as well.
This is my first patch submission to cpython so please do point out anything I've done wrong! I'd like do more work on cpython so best to nip any bad habits in the bud!
In this patch I've re-written the parsing code to support this. I've tried to re-use existing code as much as possible, so I've based the new parser on the existing parse_http_list which I had to extend so that it can be used to parse single quoted strings. These single quoted strings are not valid for the HTTP spec but apparently they do appear in the wild and the existing implementation allowed them so I've continued to allow them. I've also kept the existing behaviour with regards to unquoted realm values, a warning is raised but otherwise they are allowed. The requirement of raising the warning added a slightly awkward bit to the code, but I assumed there was a good reason for that warning being there so I kept it in.
almost commentedon Jul 9, 2012
I should mention, this fixes the same issue mentioned in bpo-13323 but more comprehensively and for python 3 (the old issue refers to urllib2 in python2).
SigmundAugdal commentedon Sep 2, 2013
I'm also affected by this. Could someone please apply the patch or provide some reason why it could not be applied?
orsenthil commentedon Oct 28, 2026
The
AbstractBasicHandlerside of supporting multipleWWW-Authenticateheader was addressed in gh-59515 - #18284 . This was left behind without getting implemented / completed.This is still a valid request. The server can still offer several schemes in one response and client should pick the strongest one it supports.
orsenthil commentedon Oct 28, 2026
On the RFC front. this is based on 2617 and still valid.
The latest RFCs that have superseded it are these.