11640 2006-11-17 20:42:14 -0800 XMLHttpRequest produces undefined:undefined HTTP authentication 2006-11-18 06:02:55 -0800 1 1 1 Unclassified WebKit XML 420+ Mac OS X 10.4 RESOLVED FIXED http://www.fulgore.net/prototype.js P2 Major --- 1 gary ap ap mrowe oldest_to_newest 45494 0 gary 2006-11-17 20:42:14 -0800 Prototype line 775 seems to be culprit. If you are authenticated to a basic realm and then use XMLHttpRequest through Prototype - it results in a request to http://undefined:undefined@hostname which in turn prevents you from being able to complete the request. Some chat transcript from bdash below: 20:13 < bdash> the prototype code calls transport.open(this.options.method.toUpperCase(), this.url, this.options.asynchronous, this.options.username, this.options.password); 20:14 < bdash> this.options is an object consisting of some default fields, merged with the configuration you pass to Ajax.Request 20:14 < bdash> there is no username or password key, so this.options.username and this.options.password are both undefined 20:15 < bdash> our behaviour obviously differs from Firefox in the case of undefined, though the work-in-progress XMLHttpRequest specification says that no username and password should be indicated by 'null' Extent of browser testing as follows: IE Windows - Request completes ok FF Windows - Request completes ok FF OSX - Request completes ok SF/WK OSX - Request fails 45491 1 gary 2006-11-17 20:59:45 -0800 RoR bug report here (and patch): http://dev.rubyonrails.org/ticket/6638 45485 2 mrowe 2006-11-17 21:00:36 -0800 Thanks for the bug report! 45473 3 11562 ap 2006-11-18 03:31:51 -0800 Created attachment 11562 proposed fix We also have issues with null parameters (and the draft XHR spec also does), but this change seems straightforward and simple enough to be made right away. 45459 4 rwlbuis 2006-11-18 04:29:46 -0800 Hi Alexey, (In reply to comment #3) > Created an attachment (id=11562) [edit] > proposed fix > > We also have issues with null parameters (and the draft XHR spec also does), > but this change seems straightforward and simple enough to be made right away. Comparing with the RoR patch, there seems to be a difference. That one passes user and password string only if both are defined, your patch passes both when user is defined but password is undefined. I am not too familiar with XHR (yet), but I can imagine this would not make sense? Cheers, Rob. 45457 5 ap 2006-11-18 04:44:02 -0800 The patch makes open(..., "login", undefined) work like open(..., "login"), which I think is correct. How the latter should work is an open issue still; quoting the current XHR editor's draft: ----------------------------- Issue: Need to look at the password argument. What syntax does it need to match. Can it be UTF-8 on transmission? When it's omitted, do UAs still use the user argument? IE doesn't. ----------------------------- 45425 6 rwlbuis 2006-11-18 05:27:26 -0800 (In reply to comment #4) > Hi Alexey, > > (In reply to comment #3) > > Created an attachment (id=11562) [edit] > > proposed fix > > > > We also have issues with null parameters (and the draft XHR spec also does), > > but this change seems straightforward and simple enough to be made right away. > > Comparing with the RoR patch, there seems to be a difference. That one passes > user and > password string only if both are defined, your patch passes both when user is > defined but > password is undefined. I am not too familiar with XHR (yet), but I can imagine > this would not make sense? ap explained that above scenario behaves like providing a user without a password, which still is an open issue for the specification. For that same reason there are no tests for this in basic-realm.html yet. With that in mind, I am going to r+ it. Cheers, Rob. 45421 7 11562 rwlbuis 2006-11-18 05:29:10 -0800 Comment on attachment 11562 proposed fix r=me 45407 8 ap 2006-11-18 06:02:55 -0800 Committed revision 17842. 11562 2006-11-18 03:31:51 -0800 2006-11-18 05:29:10 -0800 proposed fix 11640r1_patch.txt text/plain 6253 ap SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDE3ODQxKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMDYtMTEtMTggIEFsZXhleSBQcm9za3VyeWFr b3YgIDxhcEB3ZWJraXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp LgorCisgICAgICAgIGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExNjQw CisgICAgICAgIFhNTEh0dHBSZXF1ZXN0IHByb2R1Y2VzIHVuZGVmaW5lZDp1bmRlZmluZWQgSFRU UCBhdXRoZW50aWNhdGlvbgorCisgICAgICAgICogaHR0cC90ZXN0cy94bWxodHRwcmVxdWVzdC9i YXNpYy1hdXRoLWV4cGVjdGVkLnR4dDoKKyAgICAgICAgKiBodHRwL3Rlc3RzL3htbGh0dHByZXF1 ZXN0L2Jhc2ljLWF1dGguaHRtbDoKKyAgICAgICAgQWRkZWQgdGVzdHMgZm9yIHVuZGVmaW5lZC4K KwogMjAwNi0xMS0xNyAgSnVzdGluIEdhcmNpYSAgPGp1c3Rpbi5nYXJjaWFAYXBwbGUuY29tPgog CiAgICAgICAgIFJldmlld2VkIGJ5IGhhcnJpc29uCkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rl c3RzL3htbGh0dHByZXF1ZXN0L2Jhc2ljLWF1dGgtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IExheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYmFzaWMtYXV0aC1leHBlY3Rl ZC50eHQJKHJldmlzaW9uIDE3ODQwKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy94bWxodHRw cmVxdWVzdC9iYXNpYy1hdXRoLWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAtMSwxMCAr MSwxNiBAQAotVGVzdHMgZm9yIGJ1ZyA3ODc3OiBYTUxIdHRwUmVxdWVzdCBpZ25vcmVzIHVzZXJu YW1lL3Bhc3N3b3JkIHBhc3NlZCB0byBvcGVuKCkKK1Rlc3RzIGZvciBYTUxIdHRwUmVxdWVzdCBh dXRoZW50aWNhdGlvbi4KIAogc3luYzogVXNlcjogc3luYywgcGFzc3dvcmQ6IDEyMy4KIHN5bmMy OiBVc2VyOiBzeW5jMiwgcGFzc3dvcmQ6IDEyMy4KIHN5bmMzOiBVc2VyOiBzeW5jMywgcGFzc3dv cmQ6IDEyMy4KIHN5bmM0OiBVc2VyOiBzeW5jNCwgcGFzc3dvcmQ6IDEyMy4KK3N5bmM1OiBVc2Vy OiBzeW5jNSwgcGFzc3dvcmQ6IDEyMy4KK3N5bmM2OiBVc2VyOiBzeW5jNiwgcGFzc3dvcmQ6IDEy My4KK3N5bmM3OiBVc2VyOiBzeW5jNywgcGFzc3dvcmQ6IDEyMy4KIGFzeW5jOiBVc2VyOiBhc3lu YywgcGFzc3dvcmQ6IDEyMy4KIGFzeW5jMjogVXNlcjogYXN5bmMyLCBwYXNzd29yZDogMTIzLgog YXN5bmMzOiBVc2VyOiBhc3luYzMsIHBhc3N3b3JkOiAxMjMuCiBhc3luYzQ6IFVzZXI6IGFzeW5j NCwgcGFzc3dvcmQ6IDEyMy4KK2FzeW5jNTogVXNlcjogYXN5bmM1LCBwYXNzd29yZDogMTIzLgor YXN5bmM2OiBVc2VyOiBhc3luYzYsIHBhc3N3b3JkOiAxMjMuCithc3luYzc6IFVzZXI6IGFzeW5j NywgcGFzc3dvcmQ6IDEyMy4KSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJl cXVlc3QvYmFzaWMtYXV0aC5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVz dHMveG1saHR0cHJlcXVlc3QvYmFzaWMtYXV0aC5odG1sCShyZXZpc2lvbiAxNzg0MCkKKysrIExh eW91dFRlc3RzL2h0dHAvdGVzdHMveG1saHR0cHJlcXVlc3QvYmFzaWMtYXV0aC5odG1sCSh3b3Jr aW5nIGNvcHkpCkBAIC0xLDcgKzEsNiBAQAogPGh0bWw+CiA8Ym9keT4KLTxwPlRlc3RzIGZvciA8 YSBocmVmPSJodHRwOi8vYnVnemlsbGEub3BlbmRhcndpbi5vcmcvc2hvd19idWcuY2dpP2lkPTc4 NzciPmJ1ZyA3ODc3PC9hPjogCi1YTUxIdHRwUmVxdWVzdCBpZ25vcmVzIHVzZXJuYW1lL3Bhc3N3 b3JkIHBhc3NlZCB0byBvcGVuKCkKKzxwPlRlc3RzIGZvciBYTUxIdHRwUmVxdWVzdCBhdXRoZW50 aWNhdGlvbi4KIDxzY3JpcHQ+CiAgICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikg ewogICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7CkBAIC0zNiw2ICsz NSwxOCBAQCBYTUxIdHRwUmVxdWVzdCBpZ25vcmVzIHVzZXJuYW1lL3Bhc3N3b3JkCiAgICAgcmVx LnNlbmQoIiIpOwogICAgIGxvZygnc3luYzQ6ICcgKyByZXEucmVzcG9uc2VUZXh0KTsKIAorICAg IHJlcS5vcGVuKCJHRVQiLCBkb2N1bWVudC5VUkwucmVwbGFjZSgiYmFzaWMtYXV0aC5odG1sIiwg InJlc291cmNlcy9iYXNpYy1hdXRoLnBocD91aWQ9c3luYzUiKS5yZXBsYWNlKCJodHRwOi8vIiwg Imh0dHA6Ly9zeW5jNToxMjNAIiksIGZhbHNlLCB1bmRlZmluZWQsIHVuZGVmaW5lZCk7CisgICAg cmVxLnNlbmQoIiIpOworICAgIGxvZygnc3luYzU6ICcgKyByZXEucmVzcG9uc2VUZXh0KTsKKwor ICAgIHJlcS5vcGVuKCJHRVQiLCBkb2N1bWVudC5VUkwucmVwbGFjZSgiYmFzaWMtYXV0aC5odG1s IiwgInJlc291cmNlcy9iYXNpYy1hdXRoLnBocD91aWQ9c3luYzYiKS5yZXBsYWNlKCJodHRwOi8v IiwgImh0dHA6Ly9zeW5jNjoxMjNAIiksIGZhbHNlLCB1bmRlZmluZWQpOworICAgIHJlcS5zZW5k KCIiKTsKKyAgICBsb2coJ3N5bmM2OiAnICsgcmVxLnJlc3BvbnNlVGV4dCk7CisKKyAgICByZXEu b3BlbigiR0VUIiwgZG9jdW1lbnQuVVJMLnJlcGxhY2UoImJhc2ljLWF1dGguaHRtbCIsICJyZXNv dXJjZXMvYmFzaWMtYXV0aC5waHA/dWlkPXN5bmM3IikucmVwbGFjZSgiaHR0cDovLyIsICJodHRw Oi8vc3luYzc6MTIzQCIpLCBmYWxzZSwgdW5kZWZpbmVkLCAiaW5jb3JyZWN0Iik7CisgICAgcmVx LnNlbmQoIiIpOworICAgIGxvZygnc3luYzc6ICcgKyByZXEucmVzcG9uc2VUZXh0KTsKKwogICAg IC8vIGFzeW5jCiAgICAgdmFyIGFzeW5jU3RlcCA9IDE7CiAKQEAgLTY2LDcgKzc3LDI1IEBAIFhN TEh0dHBSZXF1ZXN0IGlnbm9yZXMgdXNlcm5hbWUvcGFzc3dvcmQKICAgICAgICAgICAgIHJlcS5v cGVuKCJHRVQiLCBkb2N1bWVudC5VUkwucmVwbGFjZSgiYmFzaWMtYXV0aC5odG1sIiwgInJlc291 cmNlcy9iYXNpYy1hdXRoLnBocD91aWQ9YXN5bmM0IikucmVwbGFjZSgiaHR0cDovLyIsICJodHRw Oi8vaW5jb3JyZWN0OmluY29ycmVjdEAiKSwgdHJ1ZSwgImFzeW5jNCIsICIxMjMiKTsKICAgICAg ICAgICAgIHJlcS5zZW5kKCIiKTsKICAgICAgICAgICB9IGVsc2UgaWYgKGFzeW5jU3RlcCA9PSA0 KSB7CisgICAgICAgICAgICBhc3luY1N0ZXAgPSA1OwogICAgICAgICAgICAgbG9nKCdhc3luYzQ6 ICcgKyByZXEucmVzcG9uc2VUZXh0KTsKKyAgICAgICAgICAgIHJlcS5vbnJlYWR5c3RhdGVjaGFu Z2UgPSBwcm9jZXNzU3RhdGVDaGFuZ2U7CisgICAgICAgICAgICByZXEub3BlbigiR0VUIiwgZG9j dW1lbnQuVVJMLnJlcGxhY2UoImJhc2ljLWF1dGguaHRtbCIsICJyZXNvdXJjZXMvYmFzaWMtYXV0 aC5waHA/dWlkPWFzeW5jNSIpLnJlcGxhY2UoImh0dHA6Ly8iLCAiaHR0cDovL2FzeW5jNToxMjNA IiksIHRydWUsIHVuZGVmaW5lZCwgdW5kZWZpbmVkKTsKKyAgICAgICAgICAgIHJlcS5zZW5kKCIi KTsKKyAgICAgICAgICB9IGVsc2UgaWYgKGFzeW5jU3RlcCA9PSA1KSB7CisgICAgICAgICAgICBh c3luY1N0ZXAgPSA2OworICAgICAgICAgICAgbG9nKCdhc3luYzU6ICcgKyByZXEucmVzcG9uc2VU ZXh0KTsKKyAgICAgICAgICAgIHJlcS5vbnJlYWR5c3RhdGVjaGFuZ2UgPSBwcm9jZXNzU3RhdGVD aGFuZ2U7CisgICAgICAgICAgICByZXEub3BlbigiR0VUIiwgZG9jdW1lbnQuVVJMLnJlcGxhY2Uo ImJhc2ljLWF1dGguaHRtbCIsICJyZXNvdXJjZXMvYmFzaWMtYXV0aC5waHA/dWlkPWFzeW5jNiIp LnJlcGxhY2UoImh0dHA6Ly8iLCAiaHR0cDovL2FzeW5jNjoxMjNAIiksIHRydWUsIHVuZGVmaW5l ZCk7CisgICAgICAgICAgICByZXEuc2VuZCgiIik7CisgICAgICAgICAgfSBlbHNlIGlmIChhc3lu Y1N0ZXAgPT0gNikgeworICAgICAgICAgICAgYXN5bmNTdGVwID0gNzsKKyAgICAgICAgICAgIGxv ZygnYXN5bmM2OiAnICsgcmVxLnJlc3BvbnNlVGV4dCk7CisgICAgICAgICAgICByZXEub25yZWFk eXN0YXRlY2hhbmdlID0gcHJvY2Vzc1N0YXRlQ2hhbmdlOworICAgICAgICAgICAgcmVxLm9wZW4o IkdFVCIsIGRvY3VtZW50LlVSTC5yZXBsYWNlKCJiYXNpYy1hdXRoLmh0bWwiLCAicmVzb3VyY2Vz L2Jhc2ljLWF1dGgucGhwP3VpZD1hc3luYzciKS5yZXBsYWNlKCJodHRwOi8vIiwgImh0dHA6Ly9h c3luYzc6MTIzQCIpLCB0cnVlLCB1bmRlZmluZWQsICJpbmNvcnJlY3QiKTsKKyAgICAgICAgICAg IHJlcS5zZW5kKCIiKTsKKyAgICAgICAgICB9IGVsc2UgaWYgKGFzeW5jU3RlcCA9PSA3KSB7Cisg ICAgICAgICAgICBsb2coJ2FzeW5jNzogJyArIHJlcS5yZXNwb25zZVRleHQpOwogICAgICAgICAg ICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKICAgICAgICAgICAgICAgbGF5b3V0 VGVzdENvbnRyb2xsZXIubm90aWZ5RG9uZSgpOwogICAgICAgICAgIH0KSW5kZXg6IFdlYkNvcmUv Q2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9nCShyZXZpc2lvbiAxNzg0 MSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAK KzIwMDYtMTEtMTggIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEB3ZWJraXQub3JnPgorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIGh0dHA6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExNjQwCisgICAgICAgIFhNTEh0dHBSZXF1ZXN0IHBy b2R1Y2VzIHVuZGVmaW5lZDp1bmRlZmluZWQgSFRUUCBhdXRoZW50aWNhdGlvbgorCisgICAgICAg ICogYmluZGluZ3MvanMvSlNYTUxIdHRwUmVxdWVzdC5jcHA6CisgICAgICAgIChLSlM6OkpTWE1M SHR0cFJlcXVlc3RQcm90b0Z1bmM6OmNhbGxBc0Z1bmN0aW9uKToKKyAgICAgICAgVHJlYXQgdW5k ZWZpbmVkIGNyZWRlbnRpYWxzIGFzIG1pc3Npbmcgb25lcy4KKwogMjAwNi0xMS0xNyAgTGFycyBO YWVzYnllIENocmlzdGVuc2VuICA8bGFyc25hZXNieWVAc3R1ZC5rdS5kaz4KIAogICAgICAgICBS ZXZpZXdlZCBieSBUaW0gSC4KSW5kZXg6IFdlYkNvcmUvYmluZGluZ3MvanMvSlNYTUxIdHRwUmVx dWVzdC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9iaW5kaW5ncy9qcy9KU1hNTEh0dHBSZXF1 ZXN0LmNwcAkocmV2aXNpb24gMTc4NDApCisrKyBXZWJDb3JlL2JpbmRpbmdzL2pzL0pTWE1MSHR0 cFJlcXVlc3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yMDUsMTIgKzIwNSwxMyBAQCBKU1ZhbHVl KiBKU1hNTEh0dHBSZXF1ZXN0UHJvdG9GdW5jOjpjYWxsCiAgICAgICAgICAgICAgICAgYXN5bmMg PSBhcmdzWzJdLT50b0Jvb2xlYW4oZXhlYyk7CiAKICAgICAgICAgICAgIFN0cmluZyB1c2VyOwot ICAgICAgICAgICAgaWYgKGFyZ3Muc2l6ZSgpID49IDQpCisgICAgICAgICAgICBTdHJpbmcgcGFz c3dvcmQ7CisgICAgICAgICAgICBpZiAoYXJncy5zaXplKCkgPj0gNCAmJiAhYXJnc1szXS0+aXNV bmRlZmluZWQoKSkgewogICAgICAgICAgICAgICAgIHVzZXIgPSBhcmdzWzNdLT50b1N0cmluZyhl eGVjKTsKIAotICAgICAgICAgICAgU3RyaW5nIHBhc3N3b3JkOwotICAgICAgICAgICAgaWYgKGFy Z3Muc2l6ZSgpID49IDUpCi0gICAgICAgICAgICAgICAgcGFzc3dvcmQgPSBhcmdzWzRdLT50b1N0 cmluZyhleGVjKTsKKyAgICAgICAgICAgICAgICBpZiAoYXJncy5zaXplKCkgPj0gNSAmJiAhYXJn c1s0XS0+aXNVbmRlZmluZWQoKSkKKyAgICAgICAgICAgICAgICAgICAgcGFzc3dvcmQgPSBhcmdz WzRdLT50b1N0cmluZyhleGVjKTsKKyAgICAgICAgICAgIH0KIAogICAgICAgICAgICAgcmVxdWVz dC0+bV9pbXBsLT5vcGVuKG1ldGhvZCwgdXJsLCBhc3luYywgdXNlciwgcGFzc3dvcmQsIGVjKTsK ICAgICAgICAgICAgIHNldERPTUV4Y2VwdGlvbihleGVjLCBlYyk7Cg==