[New-bugs-announce] [issue13323] urllib2 does not correctly handle multiple www-authenticate headers in an HTTP response

[David Fischer]

New submission from David Fischer <dfischer at ucsdmail.com>:

I ran into an application that responded with two www-authenticate challenges  to an HTTP request. First, it sends a standard Basic authentication challenge and then it also returns a www-authenticate header referencing another scheme. This looks legal to me according to rfc2617.

However, the regex in AbstractBasicAuthHandler that parses the www-authenticate header only grabs one of the challenges (the last one) and therefore urllib2 will not respond to the challenge with credentials.

----------
messages: 146842
nosy: dfischer
priority: normal
severity: normal
status: open
title: urllib2 does not correctly handle multiple www-authenticate headers in an HTTP response
versions: Python 2.7

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue13323>
_______________________________________