| Comment: | transport: answer an HTTP Basic challenge
A forge that gates a read answers a clone's first request with 401. The login card cannot answer that round, since its secret needs the project code the first reply teaches, and the status was fatal, so the credential never reached the wire. When a verb holds a plaintext password the transport keeps a Basic credential ready, sends nothing until a 401 names the Basic scheme, then repeats the round with the Authorization header and carries it on every later round, as fossil's --httpauth does. A 401 now says what the peer wanted. Proven by an e2e with an authenticating gate in front of zit serve. |
|---|---|
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA3-256: |
5f541eccc7745b3720785d3ba1f04ef7 |
| User & Date: | dmestas on 2026-09-18 11:31:24.851 |
| Other Links: | manifest | tags |
|
2026-09-18
| ||
| 11:37 |
Release 0.3.23
The transport answers an HTTP Basic challenge; a gated first round is no longer fatal. check-in: 2a3106fcaf user: dmestas tags: trunk, version-0.3.23 | |
| 11:31 |
transport: answer an HTTP Basic challenge
A forge that gates a read answers a clone's first request with 401. The login card cannot answer that round, since its secret needs the project code the first reply teaches, and the status was fatal, so the credential never reached the wire. When a verb holds a plaintext password the transport keeps a Basic credential ready, sends nothing until a 401 names the Basic scheme, then repeats the round with the Authorization header and carries it on every later round, as fossil's --httpauth does. A 401 now says what the peer wanted. Proven by an e2e with an authenticating gate in front of zit serve. check-in: 5f541eccc7 user: dmestas tags: trunk | |
| 01:52 |
Release 0.3.22
clone and pull authenticate; a private repository is readable. check-in: d75c7a741d user: dmestas tags: trunk, version-0.3.22 | |