Don't try to use explicit credentials with schemes that don't support it.

Don't try to use explicit credentials with schemes that don't support it.

BUG=94617
TEST=net_unittests --gtest_filter=HttpAuthControllerTest.NoExplicitCredentialsAllowed.



Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=98965

[asanka, 2011-08-29 19:55:07]

This is so that we don't spuriously prompt for credentials and keep attempting
to authenticate with the same default identity for GSSAPI on Posix.

[cbentzel, 2011-08-30 14:16:51]

LGTM

The do/while is a tad gross compared to your suggestion about iterating through
a prioritized list of headers. That will require a fairly substantial change to
this, however.

http://codereview.chromium.org/7748033/diff/7001/net/http/http_auth_controlle...
File net/http/http_auth_controller_unittest.cc (right):

http://codereview.chromium.org/7748033/diff/7001/net/http/http_auth_controlle...
net/http/http_auth_controller_unittest.cc:145: // are no viable identities to
use with this handler and fail.
Should you do test that we fallback to a less-secure auth scheme in this case?
Not quite sure how to do it with the mocking infrastructure, though.

[cbentzel, 2011-08-30 14:19:38]

http://codereview.chromium.org/7748033/diff/7001/net/http/http_auth_controlle...
File net/http/http_auth_controller.cc (right):

http://codereview.chromium.org/7748033/diff/7001/net/http/http_auth_controlle...
net/http/http_auth_controller.cc:364: // choose a different auth scheme.
May want to do HistogramAuthEvent(handler_.get(), AUTH_EVENT_REJECT) here to
match the START from above.

[asanka, 2011-08-30 18:55:44]

I agree that the loop is gross. :(

http://codereview.chromium.org/7748033/diff/7001/net/http/http_auth_controlle...
File net/http/http_auth_controller.cc (right):

http://codereview.chromium.org/7748033/diff/7001/net/http/http_auth_controlle...
net/http/http_auth_controller.cc:364: // choose a different auth scheme.
On 2011/08/30 14:19:39, cbentzel wrote:
> May want to do HistogramAuthEvent(handler_.get(), AUTH_EVENT_REJECT) here to
> match the START from above.

Done.

http://codereview.chromium.org/7748033/diff/7001/net/http/http_auth_controlle...
File net/http/http_auth_controller_unittest.cc (right):

http://codereview.chromium.org/7748033/diff/7001/net/http/http_auth_controlle...
net/http/http_auth_controller_unittest.cc:145: // are no viable identities to
use with this handler and fail.
I added a mock class that pretends to be Basic and gives itself a lower score so
we can test failover to a weaker scheme.

[cbentzel, 2011-08-31 10:45:29]

LGTM

[commit-bot: I haz the power, 2011-08-31 14:07:21]

Change committed as 98965