Add preemptive authentication support to DigestAuthMiddleware #11129
Conversation
bdraco
changed the title
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #11129 +/- ##
==========================================
- Coverage 98.85% 98.85% -0.01%
==========================================
Files 131 131
Lines 42425 42630 +205
Branches 2282 2297 +15
==========================================
+ Hits 41938 42140 +202
- Misses 337 340 +3
Partials 150 150
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
psf-chronographer
bot
added
the
bot:chronographer:provided
CodSpeed Performance ReportMerging #11129 will not alter performanceComparing Summary
|
bdraco
added
backport-3.12
Backport to 3.12: 💚 backport PR created✅ Backport PR branch: Backported as #11131 🤖 @patchback |
(cherry picked from commit c0449bb)
Backport to 3.13: 💚 backport PR created✅ Backport PR branch: Backported as #11132 🤖 @patchback |
(cherry picked from commit c0449bb)
…port to DigestAuthMiddleware (#11131) Co-authored-by: J. Nick Koston <[email protected]> Fixes #11128
…port to DigestAuthMiddleware (#11132) Co-authored-by: J. Nick Koston <[email protected]> Fixes #11128
|
|
||
| HTTP digest authentication client middleware. | ||
|
|
||
| :param str login: login | ||
| :param str password: password | ||
| :param bool preemptive: Enable preemptive authentication (default: ``True``) |
There was a problem hiding this comment.
Is there any point at all to being able to disable this? Seems like a pointless option at a glance. If it's enabled and the server doesn't recognise the header, I think it will respond just the same as if this setting was False, meaning there would be no advantage to disabling it.
There was a problem hiding this comment.
Its compatibility only as some really bad IOT device implementations choke if you send it preemptively so there needs to be a way to disable. I expect 99.9% of the time you never need to touch it.
There was a problem hiding this comment.
Perhaps, spell it out in the docs? Maybe, in a .. hint:: admonition or similar?
Also, when referencing True / False / None in Sphinx, try using the :py:data: role as that's how they are declared in the CPython docs.
What do these changes do?
It was discovered that
DigestAuthMiddlewaredoesn't work for some servers because the original implementation didn't implement preemptive support.This PR adds preemptive authentication support to
DigestAuthMiddleware, following RFC 7616 Section 3.6. The middleware now remembers successful authentication challenges and automatically includes the Authorization header in subsequent requests to the same protection space.Key changes:
preemptiveparameter toDigestAuthMiddlewareconstructor (default:True)domainparameter from server challengesdomainis specified, the entire origin becomes the protection spacestaleparameter to handle expired noncesAre there changes in behavior for the user?
Yes, but backwards compatible:
preemptive=False)Related issue number
Fixes #11128