Added authentication scheme as key to HttpAuthCache.

net/http/http_network_transaction.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/compiler_specific.h"
 #include "base/field_trial.h"
 #include "base/format_macros.h"
 #include "base/histogram.h"
@@ skipping 1761 matching lines @@
   // challenge, then we can invalidate the preemptively used entry.
   // Otherwise as-is we may send the failed credentials one extra time.
   if (auth_identity_[target].source == HttpAuth::IDENT_SRC_PATH_LOOKUP)
     return;
 
   // Clear the cache entry for the identity we just failed on.
   // Note: we require the username/password to match before invalidating
   // since the entry in the cache may be newer than what we used last time.
   session_->auth_cache()->Remove(auth_origin,
                                  auth_handler_[target]->realm(),
+                                 auth_handler_[target]->scheme(),
                                  auth_identity_[target].username,
                                  auth_identity_[target].password);
 }
 
 bool HttpNetworkTransaction::SelectPreemptiveAuth(HttpAuth::Target target) {
   DCHECK(!HaveAuth(target));
 
   // Don't do preemptive authorization if the URL contains a username/password,
   // since we must first be challenged in order to use the URL's identity.
   if (request_->url.has_username())
@@ skipping 40 matching lines @@
     GetIdentityFromURL(request_->url,
                        &auth_identity_[target].username,
                        &auth_identity_[target].password);
     embedded_identity_used_ = true;
     // TODO(eroman): If the password is blank, should we also try combining
     // with a password from the cache?
     return true;
   }
 
   // Check the auth cache for a realm entry.
-  HttpAuthCache::Entry* entry = session_->auth_cache()->LookupByRealm(
-      auth_origin, auth_handler_[target]->realm());
+  HttpAuthCache::Entry* entry =
+    session_->auth_cache()->Lookup(auth_origin, auth_handler_[target]->realm(),
+                                   auth_handler_[target]->scheme());
 
   if (entry) {
-    // Disallow re-using of identity if the scheme of the originating challenge
-    // does not match. This protects against the following situation:
-    // 1. Browser prompts user to sign into DIGEST realm="Foo".
-    // 2. Since the auth-scheme is not BASIC, the user is reasured that it
-    //    will not be sent over the wire in clear text. So they use their
-    //    most trusted password.
-    // 3. Next, the browser receives a challenge for BASIC realm="Foo". This
-    //    is the same realm that we have a cached identity for. However if
-    //    we use that identity, it would get sent over the wire in
-    //    clear text (which isn't what the user agreed to when entering it).
-    if (entry->handler()->scheme() == auth_handler_[target]->scheme()) {
-      auth_identity_[target].source = HttpAuth::IDENT_SRC_REALM_LOOKUP;
-      auth_identity_[target].invalid = false;
-      auth_identity_[target].username = entry->username();
-      auth_identity_[target].password = entry->password();
-      return true;
-    }
-    LOG(WARNING) << "The scheme of realm " << auth_handler_[target]->realm()
-                 << " has changed from " << entry->handler()->scheme()
-                 << " to " << auth_handler_[target]->scheme();
-    // Fall through.
+    auth_identity_[target].source = HttpAuth::IDENT_SRC_REALM_LOOKUP;
+    auth_identity_[target].invalid = false;
+    auth_identity_[target].username = entry->username();
+    auth_identity_[target].password = entry->password();
+    return true;
   }
 
   // Use default credentials (single sign on) if this is the first attempt
   // at identity.  Do not allow multiple times as it will infinite loop.
   // We use default credentials after checking the auth cache so that if
   // single sign-on doesn't work, we won't try default credentials for future
   // transactions.
   if (!default_credentials_used_ &&
       auth_handler_[target]->AllowsDefaultCredentials()) {
     auth_identity_[target].source = HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS;
@@ skipping 152 matching lines @@
       endpoint_);
 
   alternate_protocol_mode_ = kDoNotUseAlternateProtocol;
   if (connection_->socket())
     connection_->socket()->Disconnect();
   connection_->Reset();
   next_state_ = STATE_INIT_CONNECTION;
 }
 
 }  // namespace net