Commits on Feb 27, 2023

1. t5563: add tests for basic and anoymous HTTP access …

   Add a test showing simple anoymous HTTP access to an unprotected
   repository, that results in no credential helper invocations.
   Also add a test demonstrating simple basic authentication with
   simple credential helper support.
   
   Leverage a no-parsed headers (NPH) CGI script so that we can directly
   control the HTTP responses to simulate a multitude of good, bad and ugly
   remote server implementations around auth.
   
   Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   mjcheetham authored and gitster committed Feb 27, 2023
   Copy the full SHA

   988aad9 View commit details

   Browse the repository at this point in the history

2. http: read HTTP WWW-Authenticate response headers …

   Read and store the HTTP WWW-Authenticate response headers made for
   a particular request.
   
   This will allow us to pass important authentication challenge
   information to credential helpers or others that would otherwise have
   been lost.
   
   libcurl only provides us with the ability to read all headers recieved
   for a particular request, including any intermediate redirect requests
   or proxies. The lines returned by libcurl include HTTP status lines
   delinating any intermediate requests such as "HTTP/1.1 200". We use
   these lines to reset the strvec of WWW-Authenticate header values as
   we encounter them in order to only capture the final response headers.
   
   The collection of all header values matching the WWW-Authenticate
   header is complicated by the fact that it is legal for header fields to
   be continued over multiple lines, but libcurl only gives us each
   physical line a time, not each logical header. This line folding feature
   is deprecated in RFC 7230 [1] but older servers may still emit them, so
   we need to handle them.
   
   In the future [2] we may be able to leverage functions to read headers
   from libcurl itself, but as of today we must do this ourselves.
   
   [1] https://www.rfc-editor.org/rfc/rfc7230#section-3.2
   [2] https://daniel.haxx.se/blog/2022/03/22/a-headers-api-for-libcurl/
   
   Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   mjcheetham authored and gitster committed Feb 27, 2023
   Copy the full SHA

   6b8dda9 View commit details

   Browse the repository at this point in the history

3. credential: add WWW-Authenticate header to cred requests …

   Add the value of the WWW-Authenticate response header to credential
   requests. Credential helpers that understand and support HTTP
   authentication and authorization can use this standard header (RFC 2616
   Section 14.47 [1]) to generate valid credentials.
   
   WWW-Authenticate headers can contain information pertaining to the
   authority, authentication mechanism, or extra parameters/scopes that are
   required.
   
   The current I/O format for credential helpers only allows for unique
   names for properties/attributes, so in order to transmit multiple header
   values (with a specific order) we introduce a new convention whereby a
   C-style array syntax is used in the property name to denote multiple
   ordered values for the same property.
   
   In this case we send multiple `wwwauth[]` properties where the order
   that the repeated attributes appear in the conversation reflects the
   order that the WWW-Authenticate headers appeared in the HTTP response.
   
   Add a set of tests to exercise the HTTP authentication header parsing
   and the interop with credential helpers. Credential helpers will receive
   WWW-Authenticate information in credential requests.
   
   [1] https://datatracker.ietf.org/doc/html/rfc2616#section-14.47
   
   Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   mjcheetham authored and gitster committed Feb 27, 2023
   Copy the full SHA

   5f2117b View commit details

   Browse the repository at this point in the history