GNU bug report logs - #27022
url-retrieve + .authinfo bug

Previous Next

Full log

View this message in rfc822 format

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Andy Wingo <wingo <at> pobox.com>
Cc: 27022 <at> debbugs.gnu.org
Subject: bug#27022: url-retrieve + .authinfo bug
Date: Fri, 26 Jul 2019 10:46:40 +0200

Andy Wingo <wingo <at> pobox.com> writes:

> If you try to do a url-retrieve over HTTP on a URL that requires HTTP
> basic authentication, and you have an .authinfo file, and that .authinfo
> contains an incorrect login, then Emacs will keep appending the same
> Authorization: header to the request -- over and over, making the
> request larger and larger, with no stop condition.  Eventually nginx
> produces a "400 Bad Request" error because there were too many headers.
>
> Emacs should instead error after the first attempt at authentication
> fails.

I'm able to reproduce this with this in my .authinfo file:

machine jigsaw.w3.org:443 login guest password wrong

and then:

(url-retrieve "https://jigsaw.w3.org/HTTP/Basic/" #'ignore)

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.