GNU bug report logs - #27022
url-retrieve + .authinfo bug

Previous Next

Package: emacs;

Reported by: Andy Wingo <wingo <at> pobox.com>

Date: Mon, 22 May 2017 18:11:02 UTC

Severity: normal

Tags: fixed

Fixed in version 27.1

Done: Lars Ingebrigtsen <larsi <at> gnus.org>

Bug is archived. No further changes may be made.

Full log

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Andy Wingo <wingo <at> pobox.com>
To: bug-emacs <at> gnu.org
Subject: url-retrieve + .authinfo bug
Date: Mon, 22 May 2017 20:09:49 +0200

Hi,

If you try to do a url-retrieve over HTTP on a URL that requires HTTP
basic authentication, and you have an .authinfo file, and that .authinfo
contains an incorrect login, then Emacs will keep appending the same
Authorization: header to the request -- over and over, making the
request larger and larger, with no stop condition.  Eventually nginx
produces a "400 Bad Request" error because there were too many headers.

Emacs should instead error after the first attempt at authentication
fails.

  $ emacs --version
  GNU Emacs 25.2.1

Andy
This bug report was last modified 5 years and 298 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.