jenkinsci/jenkins — pull request #1415 by daniel-beck (2014-10-01 20:32:35+00:00)
Title: [DO NOT MERGE] [JENKINS-6610] Allow clients to request HTTP 401/WWW-Authenticate

Do not merge, but please share your thoughts on this.

---

Non-browser clients currently have the problem that they don't get a proper basic auth challenge from Jenkins for access to a restricted resource: It's just HTTP 403 Forbidden, and a redirect to the login form.

OTOH if Jenkins sends the HTTP 401 response and WWW-Authenticate header, web browsers will start showing the login popup window for basic authentication.

Would a solution like this one be acceptable? RSS clients would then need to start requesting e.g. `/rssAll?basic` to get a proper challenge, if they don't support preemptive authentication. A simple reconfiguration should do it, and for future users all links to RSS feeds on the UI could be changed.

I considered a few other solutions in a recent comment to [JENKINS-6610](https://issues.jenkins-ci.org/browse/JENKINS-6610), but all of them seem worse than this.