RESOLVED INVALID 70686
WebKit fails to prompt for basic authentication when the realm is an unquoted URL 
https://bugs.webkit.org/show_bug.cgi?id=70686
Summary WebKit fails to prompt for basic authentication when the realm is an unquoted...
Guillermo Jano
Reported 2011-10-22 16:05:36 PDT
When Safari/WebKit finds an HTTP header like the following: WWW-Authenticate: Basic realm=http://www.ennaranja.com it fails to parse the realm and thus doesn't prompt for an username/password but directly present the Authorization Required page to the user. I know this header syntax is invalid, as the parameter 'realm' is defined to only use 'quoted-string' syntax, however some other browsers as Internet Explorer or Mozilla Firefox or even the WebKit-based Google Chrome accept this unquoted form and still present the user with the prompt. I have found a study about how several browsers parse the WWW-Authenticate in different situations [ http://greenbytes.de/tech/tc/httpauth/ ] and this issue is similar to test case 'simplebasictok', which Safari passes, however I guess the non-alphanumeric characters (':', '/') in the URL make the difference in this case. This issue also affects MobileSafari in iOS 5.
Attachments
Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2011-10-26 13:04:39 PDT
<rdar://problem/10350185>
Alexey Proskuryakov
Comment 2 2011-10-26 13:07:41 PDT
Thank you for the detailed bug report! This doesn't appear to be a WebKit bug, but an issue with lower level system frameworks. Per our policy, I'm closing this as INVALID. I've also copied the bug into Apple internal tracker for engineers working on this code to investigate.
Note You need to log in before you can comment on or make changes to this bug.