Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Run into a similar problem today. I was using basic authentication on the website I am developing and I couldn't authenticate any users. </p> <p>Here are a few things you can use to debug your problem:</p> <ol> <li>I used <a href="http://slumber.in/" rel="nofollow">slumber.in</a> and <a href="http://httplib2.googlecode.com/hg/doc/html/libhttplib2.html" rel="nofollow">httplib2</a> for testing purposes. I ran both from ipython shell to see what responses I was receiving.</li> <li>Slumber actually uses httplib2 beneath the covers so they acted similarly. I used tcpdump and later tcpflow (which shows information in a much more readable form) to see what was really being sent and received. If you want a GUI, see wireshark or alternatives.</li> <li>I tested my website with curl and when I used curl with my username/password it worked correctly and showed the requested page. But slumber and httplib2 were still not working.</li> <li>I tested my website and <a href="http://browserspy.dk/password-ok.php" rel="nofollow">browserspy.dk</a> to see what were the differences. Important thing is browserspy's website works for basic authentication and my web site did not, so I could compare between the two. I read in a lot of places that you need to send HTTP 401 Not Authorized so that the browser or the tool you are using could send the username/password you provided. But what I didn't know was, you also needed the WWW-Authenticate field in the header. So this was the missing piece.</li> <li>What made this whole situation odd was while testing I would see httplib2 send basic authentication headers with most of the requests (tcpflow would show that). It turns out that the library does not send username/password authentication on the first request. If "Status 401" AND "WWW-Authenticate" is in the response, then the credentials are sent on the second request and all the requests to this domain from then on.</li> </ol> <p>So to sum up, your application may be correct but you might not be returning the standard headers and status code for the client to send credentials. Use your debug tools to find which is which. Also, there's debug mode for httplib2, just set <code>httplib2.debuglevel=1</code> so that debug information is printed on the standard output. This is much more helpful then using tcpdump because it is at a higher level.</p> <p>Hope this helps someone.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload