Authentication Handlers lost on redirect.

I'am trying to use the requests library by making a redirection with  Digest authentication method, but the response is 401. I mention that it works with basic authentication. I've captured the packets with wireshark, and noticed that the first HTTP request is without the Authorization header, the 401 unauthorized answered is received, and after that the traffic continues as it should be, the Authorization header is added, the 302 answer is received, and after that with the https cyphers exchange. I don't know why the requests.send method returns 401.


Wait, I'm confused. Your description of the wireshark trace suggests that everything is happening as expected, but you're getting an unexpected status code?


Yes, but in fact, I don't know if it is happening _exactlly_ as it should be. I tried to make a redirection from http to https. When I try with a browser it works well, and also it works well when using requests with Basic authentication. When using with Digest, what happens is as I described above (+ the https message exchange: server hello, server hello done, client key exchange, change cipher spec etc), but the send() method responds with 401.


Can I see some sample code?


The sample code is very simple:

url1 = 'http://192.168.40.248/param.cgi?action=list&group=root.AutoTracking'
res = s.get(url1, auth=requests.auth.HTTPDigestAuth('user', 'pass'), verify=False)
print res.status_code

The url1 address is automatic redirecting to : "https://192.168.40.248/..."(the same url but with https).
So, the above code prints: "401"

If I change the authentication class to HTTPBasicAuth, and change the server to also use Basic authentication, everything works well (200 is printed).

Ofcourse, you don't have access to the DUT that I use. But I suppose you can try with any URL that automatic redirects to use https and use digest auth method.


What version of requests are you using, and where did you install it from?


I am using requests-2.2.1, I've downloaded it from here: https://pypi.python.org/pypi/requests (requests-2.2.1.tar.gz).


Aha, ok.

I don't think auth handlers can handle an auth challenge that occurs _after_ a redirect: I think we lose track of the auth handler. @sigmavirus24 does this match your reading of the code?

If that's the case, do we consider that behaviour a bug?


Note: I'm renaming this issue to more accurately reflect the bug.


In the case of basic auth, the header is kept (basic auth works with redirection). In the release history, one of the updates from version 0.7.4 to version 0.7.5 is : "Redirection auth handling." , which suggests that this problem was treated.


@costinb7 Can you print the following things for me?

``` python
[x.request.headers.get('Authorization', '') for x in res.history] + [res.request.headers.get('Authorization', '')]
[x.headers.get('WWW-Authenticate', '') for x in res.history] + [res.headers.get('WWW-Authenticate', '')]
```


This is the result for the Digest auth:
- for the first line:
  ['Digest username="root", realm="AXIS_00408CC5845E", nonce="0000125dY1917315e1e3668a12ee27b941e936bef5eb05", uri="/axis-cgi/param.cgi?action=list&group=root.AutoTracking.A0.Running", response="f04e66d4f1efffc1d3021866d2a1e784", qop="auth", nc=00000001, cnonce="bfaa00a7e5656fc6"', '']
- for the second line:
  ['', 'Digest realm="AXIS_00408CC5845E", nonce="0000125dY475861fc82c8b34f5dd0c9131a4291ffbbec8", stale=FALSE, qop="auth"']

for Basic auth:
- for the first line:
  [u'Basic cm9vdDpwYXNz', u'Basic cm9vdDpwYXNz']
- for the second line:
  ['', '']


Oh, right, I get it now.

HTTP Basic and HTTP Digest are handled very differently in requests. HTTP Basic just applies a flat Authorization header to each request: HTTP Digest makes its own authentication challenge response. The important thing is that it'll only do that once: if challenged a second time, it aborts. That's exactly what's happening here.

My question is, should we try to distinguish between a 401 challenge that fails and a second 401, following a redirect?


If you are asking me, yes it would be great if this distinction could be made.


Opened a pull request please let me know if the fix is acceptable and I'll write the test.


Hey guys, I'm still having this problem (using basic auth), just wondering if you intend to fix it any time soon. Other than that the project is awesome, so thanks for that :)


@amnong We have no specific timetable for this at this time.


So it looks like this was patched with #2253 but there wasn't a test included at the time.

I've written up a [couple tests](https://gist.github.com/nateprewitt/86b4e076ab5142ede32f09dbddd2ae56) to verify the individual pieces are working as expected, but can't find a way to do a full repro with httpbin.

I'm not sure @amnong's issue was related to this since it's through `HTTPBasicAuth` which should always send the 'Authorization' header.

I'll throw up a PR with the tests if this looks right.

Alright cool, this was fixed in #2253 and we now have confirmation in the test suite with #3766.