Summary

Make authentication modular in http-client

Metadata

Description

Currently basic and digest auth are hardcoded in http-client. As Thomas Hintz pointed out, there are services like Amazon S3 that have their own homebrew (and less secure...) authentication system which re-uses the "authorization" header with a custom scheme.

It would be great if the authentication schemes were extensible so we can cope with those custom schemes without having to add them to a huge pile inside http-client itself. This is not desirable because there may be many of these one-off systems out there, and they're all nonstandard and may even change and disappear over time.

Possibly some of the standard auth stuff can be moved inside intarweb too. Not sure yet.

Changes and comments

[2011-07-20 21:53:47 UTC] sjamaan changed status from new to closed

[2011-07-20 21:53:47 UTC] sjamaan set resolution to fixed

[2011-07-20 21:53:47 UTC] sjamaan wrote:

Ugh. The authenticators need to know too much about the request/response handling because digest auth is so annoying.

At least it's in now. It really really needs to be cleaned up before it can be considered useful for extension by other eggs. At least now you *can* extend it if you must, if you're brave enough to read the source and figure out how to ;)

[2011-07-20 21:58:17 UTC] sjamaan wrote:

Turns out Amazon S3 doesn't even implement RFC 2617 properly; it doesn't send 401 responses; you need to pass the authentication stuff right along with the initial request. If you don't, it just 403s on you.

Amazon, a bunch of professional fools.

Amazon, for all your botched standards.

Amazon, what were they thinking?