Subject: url-retrieve + .authinfo bug

From: Andy Wingo <[email-masked]>
Date: Mon, 22 May 2017 20:09:49 +0200

Hi,

If you try to do a url-retrieve over HTTP on a URL that requires HTTP
basic authentication, and you have an .authinfo file, and that .authinfo
contains an incorrect login, then Emacs will keep appending the same
Authorization: header to the request -- over and over, making the
request larger and larger, with no stop condition.  Eventually nginx
produces a "400 Bad Request" error because there were too many headers.

Emacs should instead error after the first attempt at authentication
fails.

  $ emacs --version
  GNU Emacs 25.2.1

Andy