[net/auth] Don't abort network transaction over non-permanent auth errors.

net/http/http_network_transaction_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include <math.h>  // ceil
 #include <stdarg.h>
 #include <stdint.h>
 
@@ skipping 4117 matching lines @@
   ASSERT_TRUE(response);
   ASSERT_TRUE(response->headers);
   EXPECT_EQ(407, response->headers->response_code());
   EXPECT_FALSE(trans->IsReadyToRestartForAuth());
   EXPECT_TRUE(response->auth_challenge);
 
   trans.reset();
   session->CloseAllConnections();
 }
 
+// A more nuanced test than GenerateAuthToken test which asserts that
+// ERR_INVALID_AUTH_CREDENTIALS does not cause the auth scheme to be
+// unnecessarily invalidated, and that if the server co-operates, the
+// authentication handshake can continue with the same scheme but with a
+// different identity.
+TEST_F(HttpNetworkTransactionTest, NonPermanentGenerateAuthTokenError) {
+  HttpRequestInfo request;
+  request.method = "GET";
+  request.url = GURL("http://www.example.org/");
+
+  std::unique_ptr<HttpAuthHandlerMock::Factory> auth_handler_factory(
+      new HttpAuthHandlerMock::Factory());
+  auth_handler_factory->set_do_init_from_challenge(true);
+
+  // First handler. Uses default credentials, but barfs at generate auth token.
+  std::unique_ptr<HttpAuthHandlerMock> mock_handler(new HttpAuthHandlerMock());
+  mock_handler->set_allows_default_credentials(true);
+  mock_handler->set_allows_explicit_credentials(true);
+  mock_handler->set_connection_based(true);
+  mock_handler->SetGenerateExpectation(true, ERR_INVALID_AUTH_CREDENTIALS);
+  auth_handler_factory->AddMockHandler(mock_handler.release(),
+                                       HttpAuth::AUTH_SERVER);
+
+  // Add another handler for the second challenge. It supports default
+  // credentials, but they shouldn't be used, since they were already tried.
+  mock_handler.reset(new HttpAuthHandlerMock());
+  mock_handler->set_allows_default_credentials(true);
+  mock_handler->set_allows_explicit_credentials(true);
+  mock_handler->set_connection_based(true);
+  auth_handler_factory->AddMockHandler(mock_handler.release(),
+                                       HttpAuth::AUTH_SERVER);
+  session_deps_.http_auth_handler_factory = std::move(auth_handler_factory);
+
+  std::unique_ptr<HttpNetworkSession> session = CreateSession(&session_deps_);
+
+  MockWrite data_writes1[] = {
+      MockWrite("GET / HTTP/1.1\r\n"
+                "Host: www.example.org\r\n"
+                "Connection: keep-alive\r\n\r\n"),
+  };
+
+  MockRead data_reads1[] = {
+      MockRead("HTTP/1.1 401 Authentication Required\r\n"
+               "WWW-Authenticate: Mock\r\n"
+               "Connection: keep-alive\r\n\r\n"),
+  };
+
+  // Identical to data_writes1[]. The AuthHandler encounters a
+  // ERR_INVALID_AUTH_CREDENTIALS during the GenerateAuthToken stage, so the
+  // transaction procceds without an authorization header.
+  MockWrite data_writes2[] = {
+      MockWrite("GET / HTTP/1.1\r\n"
+                "Host: www.example.org\r\n"
+                "Connection: keep-alive\r\n\r\n"),
+  };
+
+  MockRead data_reads2[] = {
+      MockRead("HTTP/1.1 401 Authentication Required\r\n"
+               "WWW-Authenticate: Mock\r\n"
+               "Connection: keep-alive\r\n\r\n"),
+  };
+
+  MockWrite data_writes3[] = {
+      MockWrite("GET / HTTP/1.1\r\n"
+                "Host: www.example.org\r\n"
+                "Connection: keep-alive\r\n"
+                "Authorization: auth_token\r\n\r\n"),
+  };
+
+  MockRead data_reads3[] = {
+      MockRead("HTTP/1.1 200 OK\r\n"
+               "Content-Length: 5\r\n"
+               "Content-Type: text/plain\r\n"
+               "Connection: keep-alive\r\n\r\n"
+               "Hello"),
+  };
+
+  StaticSocketDataProvider data1(data_reads1, arraysize(data_reads1),
+                                 data_writes1, arraysize(data_writes1));
+  session_deps_.socket_factory->AddSocketDataProvider(&data1);
+
+  StaticSocketDataProvider data2(data_reads2, arraysize(data_reads2),
+                                 data_writes2, arraysize(data_writes2));
+  session_deps_.socket_factory->AddSocketDataProvider(&data2);
+
+  StaticSocketDataProvider data3(data_reads3, arraysize(data_reads3),
+                                 data_writes3, arraysize(data_writes3));
+  session_deps_.socket_factory->AddSocketDataProvider(&data3);
+
+  std::unique_ptr<HttpNetworkTransaction> trans(
+      new HttpNetworkTransaction(DEFAULT_PRIORITY, session.get()));
+
+  TestCompletionCallback callback;
+  int rv = trans->Start(&request, callback.callback(), NetLogWithSource());
+  EXPECT_THAT(callback.GetResult(rv), IsOk());
+
+  const HttpResponseInfo* response = trans->GetResponseInfo();
+  ASSERT_TRUE(response);
+  ASSERT_TRUE(response->headers);
+  EXPECT_TRUE(HttpVersion(1, 1) == response->headers->GetHttpVersion());
+
+  // The following three tests assert that an authentication challenge was
+  // received and that the stack is ready to respond to the challenge using
+  // ambient credentials.
+  EXPECT_EQ(401, response->headers->response_code());
+  EXPECT_TRUE(trans->IsReadyToRestartForAuth());
+  EXPECT_FALSE(response->auth_challenge);
+
+  rv = trans->RestartWithAuth(AuthCredentials(), callback.callback());
+  EXPECT_THAT(callback.GetResult(rv), IsOk());
+  response = trans->GetResponseInfo();
+  ASSERT_TRUE(response);
+  ASSERT_TRUE(response->headers);
+
+  // The following three tests assert that an authentication challenge was
+  // received and that the stack needs explicit credentials before it is ready
+  // to respond to the challenge.
+  EXPECT_EQ(401, response->headers->response_code());
+  EXPECT_FALSE(trans->IsReadyToRestartForAuth());
+  EXPECT_TRUE(response->auth_challenge);
+
+  rv = trans->RestartWithAuth(AuthCredentials(), callback.callback());
+  EXPECT_THAT(callback.GetResult(rv), IsOk());
+  response = trans->GetResponseInfo();
+  ASSERT_TRUE(response);
+  ASSERT_TRUE(response->headers);
+  EXPECT_EQ(200, response->headers->response_code());
+
+  trans.reset();
+  session->CloseAllConnections();
+}
+
 // Test the load timing for HTTPS requests with an HTTP proxy.
 TEST_F(HttpNetworkTransactionTest, HttpProxyLoadTimingNoPacTwoRequests) {
   HttpRequestInfo request1;
   request1.method = "GET";
   request1.url = GURL("https://www.example.org/1");
 
   HttpRequestInfo request2;
   request2.method = "GET";
   request2.url = GURL("https://www.example.org/2");
 
@@ skipping 7240 matching lines @@
 
   struct TestConfig {
     const char* const proxy_url;
     AuthTiming proxy_auth_timing;
     int proxy_auth_rv;
     const char* const server_url;
     AuthTiming server_auth_timing;
     int server_auth_rv;
     int num_auth_rounds;
     int first_ssl_round;
-    TestRound rounds[3];
+    TestRound rounds[4];
   } test_configs[] = {
       // Non-authenticating HTTP server with a direct connection.
       {NULL,
        AUTH_NONE,
        OK,
        kServer,
        AUTH_NONE,
        OK,
        1,
        kNoSSL,
@@ skipping 10 matching lines @@
        {TestRound(kGet, kServerChallenge, OK),
         TestRound(kGetAuth, kSuccess, OK)}},
       {NULL,
        AUTH_NONE,
        OK,
        kServer,
        AUTH_SYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        2,
        kNoSSL,
-       {TestRound(kGet, kServerChallenge, OK),
-        TestRound(kGetAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+       {TestRound(kGet, kServerChallenge, OK), TestRound(kGet, kSuccess, OK)}},

[mmenke, 2016/10/10 21:06:09]

Should we still have a test that hard fails here?  ERR_FAILED or something? 
Both sync and async.

[mmenke, 2016/10/10 21:06:09]

More typically, we'd see another TestRound(kGet, kServerChallenge, OK) after
this, and send another set of credentials.  Can this test fixture handle that?

[asanka, 2016/10/11 19:47:26]

The test fixture will need some minor tweaking, but I'll add another test round.
Specifically, it'll verify that the auth scheme doesn't get disabled and that it
can respond to the subsequent challenge.

       {NULL,
        AUTH_NONE,
        OK,
+       kServer,
+       AUTH_SYNC,
+       ERR_UNSUPPORTED_AUTH_SCHEME,
+       2,
+       kNoSSL,
+       {TestRound(kGet, kServerChallenge, OK), TestRound(kGet, kSuccess, OK)}},

[mmenke, 2016/10/10 21:06:10]

More typically, we'd see another TestRound(kGet, kServerChallenge, OK) after
this, and then fail (I think?) since we've given up on the original scheme,
guess this text fixture can't handle that?

[asanka, 2016/10/11 19:47:26]

Added another round. The new test round verifies that the network transaction
isn't waiting for to auth. Since there are no more auth schemes to try, the
network transaction can't proceed past the challenge.

+      {NULL,
+       AUTH_NONE,
+       OK,
+       kServer,
+       AUTH_SYNC,
+       ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS,
+       2,
+       kNoSSL,
+       {TestRound(kGet, kServerChallenge, OK), TestRound(kGet, kSuccess, OK)}},
+      {NULL,
+       AUTH_NONE,
+       OK,
        kServer,
        AUTH_ASYNC,
        OK,
        2,
        kNoSSL,
        {TestRound(kGet, kServerChallenge, OK),
         TestRound(kGetAuth, kSuccess, OK)}},
       {NULL,
        AUTH_NONE,
        OK,
        kServer,
        AUTH_ASYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        2,
        kNoSSL,
-       {TestRound(kGet, kServerChallenge, OK),
-        TestRound(kGetAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+       {TestRound(kGet, kServerChallenge, OK), TestRound(kGet, kSuccess, OK)}},
       // Non-authenticating HTTP server through a non-authenticating proxy.
       {kProxy,
        AUTH_NONE,
        OK,
        kServer,
        AUTH_NONE,
        OK,
        1,
        kNoSSL,
        {TestRound(kGetProxy, kSuccess, OK)}},
@@ skipping 10 matching lines @@
         TestRound(kGetAuthThroughProxy, kSuccess, OK)}},
       {kProxy,
        AUTH_NONE,
        OK,
        kServer,
        AUTH_SYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        2,
        kNoSSL,
        {TestRound(kGetProxy, kServerChallenge, OK),
-        TestRound(kGetAuthThroughProxy, kFailure,
-                  ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGetProxy, kSuccess, OK)}},
       {kProxy,
        AUTH_NONE,
        OK,
        kServer,
        AUTH_ASYNC,
        OK,
        2,
        kNoSSL,
        {TestRound(kGetProxy, kServerChallenge, OK),
         TestRound(kGetAuthThroughProxy, kSuccess, OK)}},
       {kProxy,
        AUTH_NONE,
        OK,
        kServer,
        AUTH_ASYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        2,
        kNoSSL,
        {TestRound(kGetProxy, kServerChallenge, OK),
-        TestRound(kGetAuthThroughProxy, kFailure,
-                  ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGetProxy, kSuccess, OK)}},
       // Non-authenticating HTTP server through an authenticating proxy.
       {kProxy,
        AUTH_SYNC,
        OK,
        kServer,
        AUTH_NONE,
        OK,
        2,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
         TestRound(kGetProxyAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_SYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        kServer,
        AUTH_NONE,
        OK,
        2,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
-        TestRound(kGetProxyAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGetProxy, kSuccess, OK)}},
       {kProxy,
        AUTH_ASYNC,
        OK,
        kServer,
        AUTH_NONE,
        OK,
        2,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
         TestRound(kGetProxyAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_ASYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        kServer,
        AUTH_NONE,
        OK,
        2,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
-        TestRound(kGetProxyAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGetProxy, kSuccess, OK)}},
       // Authenticating HTTP server through an authenticating proxy.
       {kProxy,
        AUTH_SYNC,
        OK,
        kServer,
        AUTH_SYNC,
        OK,
        3,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
         TestRound(kGetProxyAuth, kServerChallenge, OK),
         TestRound(kGetAuthWithProxyAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_SYNC,
        OK,
        kServer,
        AUTH_SYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        3,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
         TestRound(kGetProxyAuth, kServerChallenge, OK),
-        TestRound(kGetAuthWithProxyAuth, kFailure,
-                  ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGetProxyAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_ASYNC,
        OK,
        kServer,
        AUTH_SYNC,
        OK,
        3,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
         TestRound(kGetProxyAuth, kServerChallenge, OK),
         TestRound(kGetAuthWithProxyAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_ASYNC,
        OK,
        kServer,
        AUTH_SYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        3,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
         TestRound(kGetProxyAuth, kServerChallenge, OK),
-        TestRound(kGetAuthWithProxyAuth, kFailure,
-                  ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGetProxyAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_SYNC,
        OK,
        kServer,
        AUTH_ASYNC,
        OK,
        3,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
         TestRound(kGetProxyAuth, kServerChallenge, OK),
         TestRound(kGetAuthWithProxyAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_SYNC,
        OK,
        kServer,
        AUTH_ASYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        3,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
         TestRound(kGetProxyAuth, kServerChallenge, OK),
-        TestRound(kGetAuthWithProxyAuth, kFailure,
-                  ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGetProxyAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_ASYNC,
        OK,
        kServer,
        AUTH_ASYNC,
        OK,
        3,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
         TestRound(kGetProxyAuth, kServerChallenge, OK),
         TestRound(kGetAuthWithProxyAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_ASYNC,
        OK,
        kServer,
        AUTH_ASYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        3,
        kNoSSL,
        {TestRound(kGetProxy, kProxyChallenge, OK),
         TestRound(kGetProxyAuth, kServerChallenge, OK),
-        TestRound(kGetAuthWithProxyAuth, kFailure,
-                  ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGetProxyAuth, kSuccess, OK)}},
       // Non-authenticating HTTPS server with a direct connection.
       {NULL,
        AUTH_NONE,
        OK,
        kSecureServer,
        AUTH_NONE,
        OK,
        1,
        0,
        {TestRound(kGet, kSuccess, OK)}},
       // Authenticating HTTPS server with a direct connection.
       {NULL,
        AUTH_NONE,
        OK,
        kSecureServer,
        AUTH_SYNC,
        OK,
        2,
        0,
        {TestRound(kGet, kServerChallenge, OK),
         TestRound(kGetAuth, kSuccess, OK)}},
       {NULL,
        AUTH_NONE,
        OK,
        kSecureServer,
        AUTH_SYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        2,
        0,
-       {TestRound(kGet, kServerChallenge, OK),
-        TestRound(kGetAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+       {TestRound(kGet, kServerChallenge, OK), TestRound(kGet, kSuccess, OK)}},
       {NULL,
        AUTH_NONE,
        OK,
        kSecureServer,
        AUTH_ASYNC,
        OK,
        2,
        0,
        {TestRound(kGet, kServerChallenge, OK),
         TestRound(kGetAuth, kSuccess, OK)}},
       {NULL,
        AUTH_NONE,
        OK,
        kSecureServer,
        AUTH_ASYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        2,
        0,
-       {TestRound(kGet, kServerChallenge, OK),
-        TestRound(kGetAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+       {TestRound(kGet, kServerChallenge, OK), TestRound(kGet, kSuccess, OK)}},
       // Non-authenticating HTTPS server with a non-authenticating proxy.
       {kProxy,
        AUTH_NONE,
        OK,
        kSecureServer,
        AUTH_NONE,
        OK,
        1,
        0,
        {TestRound(kConnect, kProxyConnected, OK, &kGet, &kSuccess)}},
@@ skipping 10 matching lines @@
         TestRound(kGetAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_NONE,
        OK,
        kSecureServer,
        AUTH_SYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        2,
        0,
        {TestRound(kConnect, kProxyConnected, OK, &kGet, &kServerChallenge),
-        TestRound(kGetAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGet, kSuccess, OK)}},
       {kProxy,
        AUTH_NONE,
        OK,
        kSecureServer,
        AUTH_ASYNC,
        OK,
        2,
        0,
        {TestRound(kConnect, kProxyConnected, OK, &kGet, &kServerChallenge),
         TestRound(kGetAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_NONE,
        OK,
        kSecureServer,
        AUTH_ASYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        2,
        0,
        {TestRound(kConnect, kProxyConnected, OK, &kGet, &kServerChallenge),
-        TestRound(kGetAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGet, kSuccess, OK)}},
       // Non-Authenticating HTTPS server through an authenticating proxy.
       {kProxy,
        AUTH_SYNC,
        OK,
        kSecureServer,
        AUTH_NONE,
        OK,
        2,
        1,
        {TestRound(kConnect, kProxyChallenge, OK),
         TestRound(kConnectProxyAuth, kProxyConnected, OK, &kGet, &kSuccess)}},
       {kProxy,
        AUTH_SYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        kSecureServer,
        AUTH_NONE,
        OK,
        2,
        kNoSSL,
        {TestRound(kConnect, kProxyChallenge, OK),
-        TestRound(kConnectProxyAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kConnect, kProxyConnected, OK, &kGet, &kSuccess)}},
+      {kProxy,
+       AUTH_SYNC,
+       ERR_UNSUPPORTED_AUTH_SCHEME,
+       kSecureServer,
+       AUTH_NONE,
+       OK,
+       2,
+       kNoSSL,
+       {TestRound(kConnect, kProxyChallenge, OK),
+        TestRound(kConnect, kProxyConnected, OK, &kGet, &kSuccess)}},
+      {kProxy,
+       AUTH_SYNC,
+       ERR_UNEXPECTED,
+       kSecureServer,
+       AUTH_NONE,
+       OK,
+       2,
+       kNoSSL,
+       {TestRound(kConnect, kProxyChallenge, OK),
+        TestRound(kConnect, kProxyConnected, ERR_UNEXPECTED)}},
       {kProxy,
        AUTH_ASYNC,
        OK,
        kSecureServer,
        AUTH_NONE,
        OK,
        2,
        1,
        {TestRound(kConnect, kProxyChallenge, OK),
         TestRound(kConnectProxyAuth, kProxyConnected, OK, &kGet, &kSuccess)}},
       {kProxy,
        AUTH_ASYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        kSecureServer,
        AUTH_NONE,
        OK,
        2,
        kNoSSL,
        {TestRound(kConnect, kProxyChallenge, OK),
-        TestRound(kConnectProxyAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kConnect, kProxyConnected, OK, &kGet, &kSuccess)}},
       // Authenticating HTTPS server through an authenticating proxy.
       {kProxy,
        AUTH_SYNC,
        OK,
        kSecureServer,
        AUTH_SYNC,
        OK,
        3,
        1,
        {TestRound(kConnect, kProxyChallenge, OK),
         TestRound(kConnectProxyAuth, kProxyConnected, OK, &kGet,
                   &kServerChallenge),
         TestRound(kGetAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_SYNC,
        OK,
        kSecureServer,
        AUTH_SYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        3,
        1,
        {TestRound(kConnect, kProxyChallenge, OK),
         TestRound(kConnectProxyAuth, kProxyConnected, OK, &kGet,
                   &kServerChallenge),
-        TestRound(kGetAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGet, kSuccess, OK)}},
       {kProxy,
        AUTH_ASYNC,
        OK,
        kSecureServer,
        AUTH_SYNC,
        OK,
        3,
        1,
        {TestRound(kConnect, kProxyChallenge, OK),
         TestRound(kConnectProxyAuth, kProxyConnected, OK, &kGet,
                   &kServerChallenge),
         TestRound(kGetAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_ASYNC,
        OK,
        kSecureServer,
        AUTH_SYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        3,
        1,
        {TestRound(kConnect, kProxyChallenge, OK),
         TestRound(kConnectProxyAuth, kProxyConnected, OK, &kGet,
                   &kServerChallenge),
-        TestRound(kGetAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGet, kSuccess, OK)}},
       {kProxy,
        AUTH_SYNC,
        OK,
        kSecureServer,
        AUTH_ASYNC,
        OK,
        3,
        1,
        {TestRound(kConnect, kProxyChallenge, OK),
         TestRound(kConnectProxyAuth, kProxyConnected, OK, &kGet,
                   &kServerChallenge),
         TestRound(kGetAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_SYNC,
        OK,
        kSecureServer,
        AUTH_ASYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        3,
        1,
        {TestRound(kConnect, kProxyChallenge, OK),
         TestRound(kConnectProxyAuth, kProxyConnected, OK, &kGet,
                   &kServerChallenge),
-        TestRound(kGetAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGet, kSuccess, OK)}},
       {kProxy,
        AUTH_ASYNC,
        OK,
        kSecureServer,
        AUTH_ASYNC,
        OK,
        3,
        1,
        {TestRound(kConnect, kProxyChallenge, OK),
         TestRound(kConnectProxyAuth, kProxyConnected, OK, &kGet,
                   &kServerChallenge),
         TestRound(kGetAuth, kSuccess, OK)}},
       {kProxy,
        AUTH_ASYNC,
        OK,
        kSecureServer,
        AUTH_ASYNC,
        ERR_INVALID_AUTH_CREDENTIALS,
        3,
        1,
        {TestRound(kConnect, kProxyChallenge, OK),
         TestRound(kConnectProxyAuth, kProxyConnected, OK, &kGet,
                   &kServerChallenge),
-        TestRound(kGetAuth, kFailure, ERR_INVALID_AUTH_CREDENTIALS)}},
+        TestRound(kGet, kSuccess, OK)}},
   };
 
   for (size_t i = 0; i < arraysize(test_configs); ++i) {
+    SCOPED_TRACE(::testing::Message() << "Test config " << i);
     HttpAuthHandlerMock::Factory* auth_factory(
         new HttpAuthHandlerMock::Factory());
     session_deps_.http_auth_handler_factory.reset(auth_factory);
     SSLInfo empty_ssl_info;
     const TestConfig& test_config = test_configs[i];
 
     // Set up authentication handlers as necessary.
     if (test_config.proxy_auth_timing != AUTH_NONE) {
       for (int n = 0; n < 2; n++) {
         HttpAuthHandlerMock* auth_handler(new HttpAuthHandlerMock());
@@ skipping 3978 matching lines @@
   base::RunLoop().RunUntilIdle();
 
   EXPECT_TRUE(trans.GetResponseInfo()->was_fetched_via_spdy);
   HttpRequestHeaders headers;
   ASSERT_TRUE(trans.GetFullRequestHeaders(&headers));
   EXPECT_TRUE(headers.HasHeader(HttpRequestHeaders::kTokenBinding));
 }
 #endif  // !defined(OS_IOS)
 
 }  // namespace net