Fix multi-round authentication....

net/http/http_auth.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_HTTP_AUTH_H_
 #define NET_HTTP_HTTP_AUTH_H_
 #pragma once
 
 #include <set>
 #include <string>
 
 #include "base/scoped_ptr.h"
 #include "base/string16.h"
 #include "net/http/http_util.h"
 
 template <class T> class scoped_refptr;
 
 namespace net {
 
 class BoundNetLog;
 class HttpAuthHandler;
 class HttpAuthHandlerFactory;
 class HttpResponseHeaders;
 
 // Utility class for http authentication.
 class HttpAuth {
  public:
-
   // Http authentication can be done the the proxy server, origin server,
   // or both. This enum tracks who the target is.
   enum Target {
     AUTH_NONE = -1,
     // We depend on the valid targets (!= AUTH_NONE) being usable as indexes
     // in an array, so start from 0.
     AUTH_PROXY = 0,
     AUTH_SERVER = 1,
     AUTH_NUM_TARGETS = 2,
   };
 
+  // What the HTTP WWW-Authenticate/Proxy-Authenticate headers indicate about
+  // the previous authorization attempt.
+  enum AuthorizationResult {
+    AUTHORIZATION_RESULT_ACCEPT,   // The authorization attempt was accepted,
+                                   // although there still may be additional
+                                   // rounds of challenges.
+
+    AUTHORIZATION_RESULT_REJECT,   // The authorization attempt was rejected.
+
+    AUTHORIZATION_RESULT_STALE,    // (Digest) The nonce used in the
+                                   // authorization attempt is stale, but
+                                   // otherwise the attempt was valid.
+
+    AUTHORIZATION_RESULT_INVALID,  // The authentication challenge headers are
+                                   // poorly formed (the authorization attempt
+                                   // itself may have been fine).
+  };
+
   // Describes where the identity used for authentication came from.
   enum IdentitySource {
     // Came from nowhere -- the identity is not initialized.
     IDENT_SRC_NONE,
 
     // The identity came from the auth cache, by doing a path-based
     // lookup (premptive authorization).
     IDENT_SRC_PATH_LOOKUP,
 
     // The identity was extracted from a URL of the form:
@@ skipping 31 matching lines @@
   // Get the name of the header where the credentials go
   // (either Authorization or Proxy-Authorization).
   static std::string GetAuthorizationHeaderName(Target target);
 
   // Returns a string representation of a Target value that can be used in log
   // messages.
   static std::string GetAuthTargetString(Target target);
 
   // Iterate through the challenge headers, and pick the best one that
   // we support. Obtains the implementation class for handling the challenge,
-  // and passes it back in |*handler|. If the existing handler in |*handler|
-  // should continue to be used (such as for the NTLM authentication scheme),
-  // |*handler| is unchanged. If no supported challenge was found, |*handler|
-  // is set to NULL.
+  // and passes it back in |*handler|. If no supported challenge was found,
+  // |*handler| is set to NULL.
   //
   // |disabled_schemes| is the set of schemes that we should not use.
   //
-  // |origin| is used by the NTLM authentication scheme to construct the
-  // service principal name.  It is ignored by other schemes.
-  //
-  // TODO(wtc): Continuing to use the existing handler in |*handler| (for
-  // NTLM) is new behavior.  Rename ChooseBestChallenge to fully encompass
-  // what it does now.
+  // |origin| is used by the NTLM and Negotiation authentication scheme to
+  // construct the service principal name.  It is ignored by other schemes.
   static void ChooseBestChallenge(
       HttpAuthHandlerFactory* http_auth_handler_factory,
       const HttpResponseHeaders* headers,
       Target target,
       const GURL& origin,
       const std::set<std::string>& disabled_schemes,
       const BoundNetLog& net_log,
       scoped_ptr<HttpAuthHandler>* handler);
 
+  // Handle a response to a previous authentication attempt.
+  static AuthorizationResult HandleChallengeResponse(
+      HttpAuthHandler* handler,
+      const HttpResponseHeaders* headers,
+      Target target,
+      const std::set<std::string>& disabled_schemes);
+
   // ChallengeTokenizer breaks up a challenge string into the the auth scheme
   // and parameter list, according to RFC 2617 Sec 1.2:
   //    challenge = auth-scheme 1*SP 1#auth-param
   //
   // Check valid() after each iteration step in case it was malformed.
   // Also note that value() will give whatever is to the right of the equals
   // sign, quotemarks and all. Use unquoted_value() to get the logical value.
   class ChallengeTokenizer {
    public:
     ChallengeTokenizer(std::string::const_iterator begin,
@@ skipping 79 matching lines @@
     std::string::const_iterator value_end_;
 
     bool value_is_quoted_;
     bool expect_base64_token_;
   };
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_HTTP_AUTH_H_