Fix multi-round authentication....

net/http/http_auth_controller.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_controller.h"
 
+#include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "net/base/auth.h"
 #include "net/base/host_resolver.h"
 #include "net/base/net_util.h"
 #include "net/http/http_auth_handler.h"
 #include "net/http/http_auth_handler_factory.h"
 #include "net/http/http_network_session.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_request_info.h"
 #include "net/http/http_response_headers.h"
@@ skipping 127 matching lines @@
   auth_token_.clear();
 }
 
 int HttpAuthController::HandleAuthChallenge(
     scoped_refptr<HttpResponseHeaders> headers,
     bool do_not_send_server_auth,
     bool establishing_tunnel,
     const BoundNetLog& net_log) {
   DCHECK(headers);
   DCHECK(auth_origin_.is_valid());
-
   LOG(INFO) << "The " << HttpAuth::GetAuthTargetString(target_) << " "
             << auth_origin_ << " requested auth"
             << AuthChallengeLogMessage(headers.get());
 
-  // The auth we tried just failed, hence it can't be valid. Remove it from
-  // the cache so it won't be used again.
-  // TODO(wtc): IsFinalRound is not the right condition.  In a multi-round
-  // auth sequence, the server may fail the auth in round 1 if our first
-  // authorization header is broken.  We should inspect response_.headers to
-  // determine if the server already failed the auth or wants us to continue.
-  // See http://crbug.com/21015.
-  if (HaveAuth() && handler_->IsFinalRound()) {
-    InvalidateRejectedAuthFromCache();
-    handler_.reset();
-    identity_ = HttpAuth::Identity();
+  // Give the existing auth handler first try at the authentication headers.
+  // This will also evict the entry in the HttpAuthCache if the previous
+  // challenge appeared to be rejected, or is using a stale nonce in the Digest
+  // case.
+  if (HaveAuth()) {
+    HttpAuth::AuthorizationResult result = HttpAuth::HandleChallengeResponse(
+        handler_.get(), headers, target_, disabled_schemes_);
+    switch (result) {
+      case HttpAuth::AUTHORIZATION_RESULT_ACCEPT:
+        break;
+      case HttpAuth::AUTHORIZATION_RESULT_INVALID:
+      case HttpAuth::AUTHORIZATION_RESULT_REJECT:
+        InvalidateCurrentHandler();
+        break;
+      case HttpAuth::AUTHORIZATION_RESULT_STALE:
+        // TODO(cbentzel): Support "stale" invalidation in HttpAuthCache.
+        // Right now this does the same invalidation as before.
+        InvalidateCurrentHandler();
+        break;
+      default:
+        NOTREACHED();
+        break;
+    }
   }
 
   identity_.invalid = true;
 
-  if (target_ != HttpAuth::AUTH_SERVER || !do_not_send_server_auth) {
+  bool can_send_auth = (target_ != HttpAuth::AUTH_SERVER ||
+                        !do_not_send_server_auth);
+  if (!handler_.get() && can_send_auth) {
     // Find the best authentication challenge that we support.
     HttpAuth::ChooseBestChallenge(session_->http_auth_handler_factory(),
                                   headers, target_, auth_origin_,
                                   disabled_schemes_, net_log,
                                   &handler_);
   }
 
   if (!handler_.get()) {
     if (establishing_tunnel) {
       LOG(ERROR) << "Can't perform auth to the "
@@ skipping 11 matching lines @@
     // so we end up displaying the error page.
     return OK;
   }
 
   if (handler_->NeedsIdentity()) {
     // Pick a new auth identity to try, by looking to the URL and auth cache.
     // If an identity to try is found, it is saved to identity_.
     SelectNextAuthIdentityToTry();
   } else {
     // Proceed with the existing identity or a null identity.
-    //
-    // TODO(wtc): Add a safeguard against infinite transaction restarts, if
-    // the server keeps returning "NTLM".
     identity_.invalid = false;
   }
 
   // From this point on, we are restartable.
 
   if (identity_.invalid) {
     // We have exhausted all identity possibilities, all we can do now is
     // pass the challenge information back to the client.
     PopulateAuthChallenge();
   } else {
@@ skipping 37 matching lines @@
       break;
     default:
       session_->auth_cache()->Add(auth_origin_, handler_->realm(),
                                   handler_->scheme(), handler_->challenge(),
                                   identity_.username, identity_.password,
                                   auth_path_);
       break;
   }
 }
 
+void HttpAuthController::InvalidateCurrentHandler() {
+  InvalidateRejectedAuthFromCache();
+  handler_.reset();
+  identity_ = HttpAuth::Identity();
+}
+
 void HttpAuthController::InvalidateRejectedAuthFromCache() {
   DCHECK(HaveAuth());
 
   // TODO(eroman): this short-circuit can be relaxed. If the realm of
   // the preemptively used auth entry matches the realm of the subsequent
   // challenge, then we can invalidate the preemptively used entry.
   // Otherwise as-is we may send the failed credentials one extra time.
   if (identity_.source == HttpAuth::IDENT_SRC_PATH_LOOKUP)
     return;
 
@@ skipping 19 matching lines @@
                        &identity_.username,
                        &identity_.password);
     embedded_identity_used_ = true;
     // TODO(eroman): If the password is blank, should we also try combining
     // with a password from the cache?
     return true;
   }
 
   // Check the auth cache for a realm entry.
   HttpAuthCache::Entry* entry =
-    session_->auth_cache()->Lookup(auth_origin_, handler_->realm(),
-                                   handler_->scheme());
+      session_->auth_cache()->Lookup(auth_origin_, handler_->realm(),
+                                     handler_->scheme());
 
   if (entry) {
     identity_.source = HttpAuth::IDENT_SRC_REALM_LOOKUP;
     identity_.invalid = false;
     identity_.username = entry->username();
     identity_.password = entry->password();
     return true;
   }
 
   // Use default credentials (single sign on) if this is the first attempt
@@ skipping 44 matching lines @@
 
 bool HttpAuthController::IsAuthSchemeDisabled(const std::string& scheme) const {
   return disabled_schemes_.find(scheme) != disabled_schemes_.end();
 }
 
 void HttpAuthController::DisableAuthScheme(const std::string& scheme) {
   disabled_schemes_.insert(scheme);
 }
 
 }  // namespace net