urllib2, basic authentication, & 302

[jcollie]

BPO	468948
Files	urllib2-basicauth.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2001-11-09.16:49:36.000>
created_at = <Date 2001-10-08.04:19:23.000>
labels = ['library']
title = 'urllib2, basic authentication, & 302'
updated_at = <Date 2001-11-09.16:49:36.000>
user = 'https://bugs.python.org/jcollie'

bugs.python.org fields:

activity = <Date 2001-11-09.16:49:36.000>
actor = 'jhylton'
assignee = 'jhylton'
closed = True
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2001-10-08.04:19:23.000>
creator = 'jcollie'
dependencies = []
files = ['151']
hgrepos = []
issue_num = 468948
keywords = []
message_count = 5.0
messages = ['6865', '6866', '6867', '6868', '6869']
nosy_count = 2.0
nosy_names = ['jhylton', 'jcollie']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = None
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue468948'
versions = []

[jcollie]

I've found a bug in how urllib2 handles
authentication. The crux of the problem is that the
AbstractBasicAuthHandler.__current_realm is basically
a global variable. I discovered the bug because I
needed to use HTTP basic authentication and the HTTP
If-Modified-Since header. Since the HTTP server
returns a 302 error if the requested URL has not
changed the line of code that resets
AbstractBasicAuthHandler.__current_realm back to None
never gets executed because an exception will be
raised when the retrieval is retried. I suspect that
this bug would also cause problems in multi-threaded
code. The digest authentication appears to have
similar problems.

The solution that I found is to get rid of the
__current_realm attribute and prevent infinite retries
by checking for the presence of an Authenticate: header
in the request object that exactly matches the
Authenticate: header that would be added.

The bug exists in 2.1.1, 2.2a4 and the current CVS.

Patch attached.

[jcollie]

Logged In: YES
user_id=37310

Oops, that patch that I attached is reversed, use -R!

[jhylton]

Logged In: YES
user_id=31392

Does the patch in bug bpo-451295 fix your problem?

[jcollie]

Logged In: YES
user_id=37310

I haven't tried the patch yet but I think that it would fix
the bug in the case of a single-threaded program. However,
with a multi-threaded program I think that my patch for
this problem is superior because it doesn't rely on a
property shared by all of the threads that use the same
opener object. Of course, my patch assumes that a request
object is used only by one thread but I think that that's a
safer assumption.

[jhylton]

Logged In: YES
user_id=31392

Fixed in rev. 1.24 of urllib2.py, including changes to
digest authentication.