romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-03 07:10:29 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: for basic+digest auth, do not engage on empty user+passwd

Browse source 
Since we have the quirky of empty credentials (the empty string for
username and password) for Negotiate reactivated, we need to check for
this when considering Basic and Digest auth.

Verify a redirect to blank user+password in test 2208

Closes #22060
This commit is contained in:
Stefan Eissing 2026-06-17 12:06:29 +02:00 • committed by Daniel Stenberg
parent 8c3ef95adf
commit d2886c5ac4
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 105 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

1
tests/data/Makefile.am
View file

@ -256,6 +256,7 @@ test2088 test2089 test2090 test2091 test2092 \
test2100 test2101 test2102 test2103 test2104 test2105 test2106 test2107 \
\
test2200 test2201 test2202 test2203 test2204 test2205 test2206 test2207 \
test2208 \
\
test2300 test2301 test2302 test2303 test2304 test2306 test2307 test2308 \
test2309 test2310 \

90
tests/data/test2208 Normal file
View file

@ -0,0 +1,90 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
HTTP
HTTP proxy
--location
HTTP Basic auth
</keywords>
</info>
# Server-side
<reply>
<data>
HTTP/1.1 301 redirect
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Content-Length: 0
Connection: close
Content-Type: text/html
Location: http://@firsthost.com:9999/a/path/%TESTNUMBER0002
</data>
<data2>
HTTP/1.1 200 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Content-Length: 4
Connection: close
Content-Type: text/html
hey
</data2>
<datacheck>
HTTP/1.1 301 redirect
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Content-Length: 0
Connection: close
Content-Type: text/html
Location: http://@firsthost.com:9999/a/path/%TESTNUMBER0002
HTTP/1.1 200 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Content-Length: 4
Connection: close
Content-Type: text/html
hey
</datacheck>
</reply>
# Client-side
<client>
<features>
proxy
</features>
<server>
http
</server>
<name>
HTTP auth on redirect with empty URL userinfo
</name>
<command>
-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -u joe:secret
</command>
</client>
# Verify data after the test has been "shot"
<verify>
<protocol crlf="headers">
GET http://firsthost.com/ HTTP/1.1
Host: firsthost.com
Authorization: Basic %b64[joe:secret]b64%
User-Agent: curl/%VERSION
Accept: */*
Proxy-Connection: Keep-Alive
GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
Host: firsthost.com:9999
User-Agent: curl/%VERSION
Accept: */*
Proxy-Connection: Keep-Alive
</protocol>
</verify>
</testcase>