Fix multi-round authentication....

net/http/http_auth_handler.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_HTTP_AUTH_HANDLER_H_
 #define NET_HTTP_HTTP_AUTH_HANDLER_H_
 #pragma once
 
 #include <string>
 
@@ skipping 20 matching lines @@
   // Initializes the handler using a challenge issued by a server.
   // |challenge| must be non-NULL and have already tokenized the
   // authentication scheme, but none of the tokens occuring after the
   // authentication scheme. |target| and |origin| are both stored
   // for later use, and are not part of the initial challenge.
   bool InitFromChallenge(HttpAuth::ChallengeTokenizer* challenge,
                          HttpAuth::Target target,
                          const GURL& origin,
                          const BoundNetLog& net_log);
 
+  // Determines how the previous authorization attempt was received.
+  //
+  // This is called when the server/proxy responds with a 401/407 after an
+  // earlier authorization attempt. Although this normally means that the
+  // previous attempt was rejected, in multi-round schemes such as
+  // NTLM+Negotiate it may indicate that another round of challenge+response
+  // is required. For Digest authentication it may also mean that the previous
+  // attempt used a stale nonce (and nonce-count) and that a new attempt should
+  // be made with a different nonce provided in the challenge.
+  //
+  // |challenge| must be non-NULL and have already tokenized the
+  // authentication scheme, but none of the tokens occuring after the
+  // authentication scheme.
+  virtual HttpAuth::AuthorizationResult HandleAnotherChallenge(
+      HttpAuth::ChallengeTokenizer* challenge) = 0;
+
   // Generates an authentication token, potentially asynchronously.
   //
   // When |username| and |password| are NULL, the default credentials for
   // the currently logged in user are used. |AllowsDefaultCredentials()| MUST be
   // true in this case.
   //
   // |request|, |callback|, and |auth_token| must be non-NULL.
   //
   // The return value is a net error code.
   // If |OK| is returned, |*auth_token| is filled in with an authentication
@@ skipping 49 matching lines @@
   bool is_connection_based() const {
     return (properties_ & IS_CONNECTION_BASED) != 0;
   }
 
   // Returns true if the response to the current authentication challenge
   // requires an identity.
   // TODO(wtc): Find a better way to handle a multi-round challenge-response
   // sequence used by a connection-based authentication scheme.
   virtual bool NeedsIdentity() { return true; }
 
-  // Returns true if this is the final round of the authentication sequence.
-  // For Basic and Digest, the method always returns true because they are
-  // single-round schemes.
-  virtual bool IsFinalRound() { return true; }
-
   // Returns whether the default credentials may be used for the |origin| passed
   // into |InitFromChallenge|. If true, the user does not need to be prompted
   // for username and password to establish credentials.
   // NOTE: SSO is a potential security risk.
   // TODO(cbentzel): Add a pointer to Firefox documentation about risk.
   virtual bool AllowsDefaultCredentials() { return false; }
 
  protected:
   enum Property {
     ENCRYPTS_IDENTITY = 1 << 0,
@@ skipping 50 matching lines @@
   CompletionCallback* original_callback_;
   CompletionCallbackImpl<HttpAuthHandler> wrapper_callback_;
   // When GenerateAuthToken was called.
   base::TimeTicks generate_auth_token_start_;
   scoped_refptr<Histogram> histogram_;
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_HTTP_AUTH_HANDLER_H_