feat: add the auth.www-authenticate features - #715
Merged
Merged
Conversation
RFC7235 section 3.1 requires a 401 to name an authentication scheme, and a server that omits it - or names only schemes this library cannot use - leaves nothing to negotiate: the password is never transmitted and the bare 401 surfaces as an AuthorizationError indistinguishable from a rejected one. The two features record which of the two it is, so the auth_type such a server needs is documented rather than folklore. Probed by caldav-server-tester's CheckWWWAuthenticate. The grouping node derives nothing from its children, since _derive_from_subfeatures skips a child with its own default; six nodes have that shape, so it is filed rather than worked around. Prompt: #713 - please create a check [in the caldav-server-tester project] for this (server expecting basic auth, but not yielding any WWW-Authenticate-header) Followup-Prompt: (comment from the review process) I thought Google used Bearer and not Basic? Meaning that the solution "slap Basic if no auth_scheme given" will fail? Followup-Prompt: (comment from the review process - clarifying that a "documentation issue" found was actually a code bug) a _parent_ that carries it's own default should not derive from the children. However, a parent without a default (and without a check) should always derive from it's children (certainly including _real_ child features - those that do have a check and an explicit default value). If it's a bug, then it should be filed. Assisted-By: Claude Opus 5 <noreply@anthropic.com> Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>
tobixen
added a commit
that referenced
this pull request
Sep 21, 2026
RFC 7235 section 3.1 requires a 401 to name an authentication scheme. Yahoo Calendar omit it entirely, so `_should_negotiate_auth` never fires, `build_auth_object()` is never called, the credentials are never sent, and the bare 401 surfaces as `AuthorizationError` indistinguishable from a genuinely rejected password. This is a general fallback rather than a feature-flag-gated one, since a first-time connection to an unrecognised server has no compatibility hints to consult yet. Added `_should_attempt_unprompted_basic`/`_build_unprompted_basic_auth` in base_client.py, wired into both the sync and async request loops. The guess fires once, only over TLS, and only when neither `auth_type` nor `auth` was already configured (either would already have taken effect before this code path is reached). #715 documents the same server behaviour via compatibility_hints for known servers; this is the general, unconditional counterpart for servers with no profile at all. Prompt: Look into issue #713. Is it still relevant for the 3.3-series? [#713] Followup-Prompt: I think we may want a general workaround that can work without features specified (but the check and feature-flag for it was created in a parallell branch/pull request). "if no www-auth header given, no auth_type set, and TLS in place, try out basic auth". (sic) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>
tobixen
added a commit
that referenced
this pull request
Sep 21, 2026
RFC 7235 section 3.1 requires a 401 to name an authentication scheme. Yahoo Calendar omits it entirely, so `_should_negotiate_auth` never fires, `build_auth_object()` is never called, the credentials are never sent, and the bare 401 surfaces as `AuthorizationError` indistinguishable from a genuinely rejected password. This is a general fallback rather than a feature-flag-gated one, since a first-time connection to an unrecognised server has no compatibility hints to consult yet. Added `_should_attempt_unprompted_basic`/`_build_unprompted_basic_auth` in base_client.py, wired into both the sync and async request loops. The guess fires once, only over TLS, and only when neither `auth_type` nor `auth` was already configured (either would already have taken effect before this code path is reached). #715 documents the same server behaviour via compatibility_hints for known servers; this is the general, unconditional counterpart for servers with no profile at all. Prompt: Look into issue #713. Is it still relevant for the 3.3-series? [#713] Followup-Prompt: I think we may want a general workaround that can work without features specified (but the check and feature-flag for it was created in a parallell branch/pull request). "if no www-auth header given, no auth_type set, and TLS in place, try out basic auth". (sic) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>
tobixen
added a commit
that referenced
this pull request
Sep 21, 2026
RFC 7235 section 3.1 requires a 401 to name an authentication scheme. Yahoo Calendar omits it entirely, so `_should_negotiate_auth` never fires, `build_auth_object()` is never called, the credentials are never sent, and the bare 401 surfaces as `AuthorizationError` indistinguishable from a genuinely rejected password. This is a general fallback rather than a feature-flag-gated one, since a first-time connection to an unrecognised server has no compatibility hints to consult yet. Added `_should_attempt_unprompted_basic`/`_build_unprompted_basic_auth` in base_client.py, wired into both the sync and async request loops. The guess fires once, only over TLS, and only when neither `auth_type` nor `auth` was already configured (either would already have taken effect before this code path is reached). #715 documents the same server behaviour via compatibility_hints for known servers; this is the general, unconditional counterpart for servers with no profile at all. Prompt: Look into issue #713. Is it still relevant for the 3.3-series? [#713] Followup-Prompt: I think we may want a general workaround that can work without features specified (but the check and feature-flag for it was created in a parallell branch/pull request). "if no www-auth header given, no auth_type set, and TLS in place, try out basic auth". (sic) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>
tobixen
added a commit
that referenced
this pull request
Sep 21, 2026
RFC 7235 section 3.1 requires a 401 to name an authentication scheme. Yahoo Calendar omits it entirely, so `_should_negotiate_auth` never fires, `build_auth_object()` is never called, the credentials are never sent, and the bare 401 surfaces as `AuthorizationError` indistinguishable from a genuinely rejected password. This is a general fallback rather than a feature-flag-gated one, since a first-time connection to an unrecognised server has no compatibility hints to consult yet. Added `_should_attempt_unprompted_basic`/`_build_unprompted_basic_auth` in base_client.py, wired into both the sync and async request loops. The guess fires once, only over TLS, and only when neither `auth_type` nor `auth` was already configured (either would already have taken effect before this code path is reached). #715 documents the same server behaviour via compatibility_hints for known servers; this is the general, unconditional counterpart for servers with no profile at all. Prompt: Look into issue #713. Is it still relevant for the 3.3-series? [#713] Followup-Prompt: I think we may want a general workaround that can work without features specified (but the check and feature-flag for it was created in a parallell branch/pull request). "if no www-auth header given, no auth_type set, and TLS in place, try out basic auth". (sic) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is partly a response to #713 - together with the similar pull request in the caldav-server-tester library we can now probe servers to see if they give away the www-authenticate-header or not.
Commit message: