]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: htx: send the proper authenticate header when using http-request auth
authorJérôme Magnin <jmagnin@haproxy.com>
Fri, 28 Dec 2018 13:49:08 +0000 (14:49 +0100)
committerWilly Tarreau <w@1wt.eu>
Fri, 28 Dec 2018 14:48:12 +0000 (15:48 +0100)
When we use htx and http-request auth rules, we need to send WWW-Authenticate
with a 401 and Proxy-Authenticate with a 407. We only sent Proxy-Authenticate
regardless of status, with htx enabled.

To be backported to 1.9.

src/proto_htx.c

index 4573c6891a6f3868d241dd029562bbd34fd7b1f7..2a021938e4edaee13f7c1d382fc931b01d2f09f3 100644 (file)
@@ -5435,10 +5435,12 @@ static int htx_reply_40x_unauthorized(struct stream *s, const char *auth_realm)
 
         if (!htx_add_header(htx, ist("Cache-Control"), ist("no-cache")) ||
            !htx_add_header(htx, ist("Connection"), ist("close")) ||
-           !htx_add_header(htx, ist("Content-Type"), ist("text/html")) ||
-           !htx_add_header(htx, ist("Proxy-Authenticate"), ist2(trash.area, trash.data)))
+           !htx_add_header(htx, ist("Content-Type"), ist("text/html")))
+               goto fail;
+       if (status == 401 && !htx_add_header(htx, ist("WWW-Authenticate"), ist2(trash.area, trash.data)))
+               goto fail;
+       if (status == 407 && !htx_add_header(htx, ist("Proxy-Authenticate"), ist2(trash.area, trash.data)))
                goto fail;
-
        if (!htx_add_endof(htx, HTX_BLK_EOH) || !htx_add_data(htx, body) || !htx_add_endof(htx, HTX_BLK_EOM))
                goto fail;