Invalidate credentials if the server rejects them.

net/http/http_auth_handler_basic.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_handler_basic.h"
 
 #include <string>
 
 #include "base/base64.h"
 #include "base/string_util.h"
@@ skipping 35 matching lines @@
 
   if (!parameters.valid())
     return false;
 
   realm_ = realm;
   return true;
 }
 
 HttpAuth::AuthorizationResult HttpAuthHandlerBasic::HandleAnotherChallenge(
     HttpAuth::ChallengeTokenizer* challenge) {
-  // Basic authentication is always a single round, so any responses should
-  // be treated as a rejection.
-  return HttpAuth::AUTHORIZATION_RESULT_REJECT;
+  // Basic authentication is always a single round, so any responses
+  // should be treated as a rejection.  However, if the new challenge
+  // is for a different realm, then indicate the realm change.
+  HttpUtil::NameValuePairsIterator parameters = challenge->param_pairs();
+  std::string realm;
+  while (parameters.GetNext()) {
+    if (LowerCaseEqualsASCII(parameters.name(), "realm")) {
+      realm = parameters.value();
+      break;

[wtc, 2011/02/22 23:17:32]

Nit: this while loop should match the while loop in
ParseChallenge (lines 41-45 exactly).

If multiple 'realm' parameters are present, that while loop
takes the last one whereas this while loop takes the first
one.

Your HttpAuthHandlerDigest::HandleAnotherChallenge doesn't
have a 'break' statement in the while loop either.

[asanka, 2011/02/23 18:06:40]

Will fix in a new CL.
In the Digest case, that was to give precedence to the "stale" directive if
there was one, but that has the side-effect of picking the last 'realm'
directive if there is more than one.

+    }
+  }
+  return (realm_ != realm)?
+      HttpAuth::AUTHORIZATION_RESULT_DIFFERENT_REALM:
+      HttpAuth::AUTHORIZATION_RESULT_REJECT;
 }
 
 int HttpAuthHandlerBasic::GenerateAuthTokenImpl(
     const string16* username,
     const string16* password,
     const HttpRequestInfo*,
     CompletionCallback*,
     std::string* auth_token) {
   // TODO(eroman): is this the right encoding of username/password?
   std::string base64_username_password;
@@ skipping 23 matching lines @@
   // TODO(cbentzel): Move towards model of parsing in the factory
   //                 method and only constructing when valid.
   scoped_ptr<HttpAuthHandler> tmp_handler(new HttpAuthHandlerBasic());
   if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log))
     return ERR_INVALID_RESPONSE;
   handler->swap(tmp_handler);
   return OK;
 }
 
 }  // namespace net