Don't use IDENT_SRC_URL for HttpAuth challenges. IE hasn't supported it for years, and at worst ...

net/http/http_auth_controller.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_HTTP_AUTH_CONTROLLER_H_
 #define NET_HTTP_HTTP_AUTH_CONTROLLER_H_
 #pragma once
 
 #include <set>
 #include <string>
@@ skipping 15 matching lines @@
 class HttpAuthHandler;
 class HttpAuthHandlerFactory;
 class HttpAuthCache;
 class HttpRequestHeaders;
 struct HttpRequestInfo;
 
 class NET_EXPORT_PRIVATE HttpAuthController
     : public base::RefCounted<HttpAuthController>,
       NON_EXPORTED_BASE(public base::NonThreadSafe) {
  public:
+  // Options for the handling of auth challenges.
+  enum ChallengeOption {
+    CHALLENGE_OPTION_NONE = 0,
+    CHALLENGE_OPTION_SEND_SERVER_AUTH = 1,

[cbentzel, 2012/02/06 15:55:38]

Perhaps 0x1 << 0, 0x1 << 2, etc. to better indicate that this a bitmask.

[Tom Sepez, 2012/02/06 18:05:30]

Sure, will do.

+    CHALLENGE_OPTION_USE_EMBEDDED_AUTH = 2,
+    CHALLENGE_OPTION_ESTABLISHING_TUNNEL = 4

[cbentzel, 2012/02/06 15:55:38]

"ESTABLISHING_TUNNEL" doesn't feel like much of an option - it's more of a
description of the current state. If you want to lump it in here to make callers
more obvious, I guess I'm OK but it feels like a stretch.

[Tom Sepez, 2012/02/06 18:05:30]

Understood.  I'd like to keep it here though for the sake of clarity.

+  };
+
   // The arguments are self explanatory except possibly for |auth_url|, which
   // should be both the auth target and auth path in a single url argument.
   HttpAuthController(HttpAuth::Target target,
                      const GURL& auth_url,
                      HttpAuthCache* http_auth_cache,
                      HttpAuthHandlerFactory* http_auth_handler_factory);
 
   // Generate an authentication token for |target| if necessary. The return
   // value is a net error code. |OK| will be returned both in the case that
   // a token is correctly generated synchronously, as well as when no tokens
   // were necessary.
   virtual int MaybeGenerateAuthToken(const HttpRequestInfo* request,
                                      const CompletionCallback& callback,
                                      const BoundNetLog& net_log);
 
   // Adds either the proxy auth header, or the origin server auth header,
   // as specified by |target_|.
   virtual void AddAuthorizationHeader(
       HttpRequestHeaders* authorization_headers);
 
   // Checks for and handles HTTP status code 401 or 407.
   // |HandleAuthChallenge()| returns OK on success, or a network error code
   // otherwise. It may also populate |auth_info_|.
   virtual int HandleAuthChallenge(scoped_refptr<HttpResponseHeaders> headers,
-                                  bool do_not_send_server_auth,
-                                  bool establishing_tunnel,
+                                  int challenge_option_mask,

[cbentzel, 2012/02/06 15:55:38]

ChallengeOption should be fine here.

[Tom Sepez, 2012/02/06 18:05:30]

It's that idiotic way that c++ handles or's of enums, which result in type int
and can't be passed to the enum without a cast by the caller, which is nice to
avoid.  I'll change it,

                                   const BoundNetLog& net_log);
 
   // Store the supplied credentials and prepare to restart the auth.
   virtual void ResetAuth(const AuthCredentials& credentials);
 
   virtual bool HaveAuthHandler() const;
 
   virtual bool HaveAuth() const;
 
   virtual scoped_refptr<AuthChallengeInfo> auth_info();
@@ skipping 24 matching lines @@
   // the cached credentials used by the handler.
   void InvalidateCurrentHandler(InvalidateHandlerAction action);
 
   // Invalidates any auth cache entries after authentication has failed.
   // The identity that was rejected is |identity_|.
   void InvalidateRejectedAuthFromCache();
 
   // Sets |identity_| to the next identity that the transaction should try. It
   // chooses candidates by searching the auth cache and the URL for a
   // username:password. Returns true if an identity was found.
-  bool SelectNextAuthIdentityToTry();
+  bool SelectNextAuthIdentityToTry(int challenge_option_mask);
 
   // Populates auth_info_ with the challenge information, so that
   // URLRequestHttpJob can prompt for credentials.
   void PopulateAuthChallenge();
 
   // If |result| indicates a permanent failure, disables the current
   // auth scheme for this controller and returns true.  Returns false
   // otherwise.
   bool DisableOnAuthHandlerResult(int result);
 
@@ skipping 45 matching lines @@
   HttpAuthHandlerFactory* const http_auth_handler_factory_;
 
   std::set<HttpAuth::Scheme> disabled_schemes_;
 
   CompletionCallback callback_;
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_HTTP_AUTH_CONTROLLER_H_