fix: Tolerate missing WWW-Authenticate-header (yahoo) - #718
Merged
Merged
Conversation
RFC 7235 section 3.1 requires a 401 to name an authentication scheme. Yahoo Calendar omits it entirely, so `_should_negotiate_auth` never fires, `build_auth_object()` is never called, the credentials are never sent, and the bare 401 surfaces as `AuthorizationError` indistinguishable from a genuinely rejected password. This is a general fallback rather than a feature-flag-gated one, since a first-time connection to an unrecognised server has no compatibility hints to consult yet. Added `_should_attempt_unprompted_basic`/`_build_unprompted_basic_auth` in base_client.py, wired into both the sync and async request loops. The guess fires once, only over TLS, and only when neither `auth_type` nor `auth` was already configured (either would already have taken effect before this code path is reached). #715 documents the same server behaviour via compatibility_hints for known servers; this is the general, unconditional counterpart for servers with no profile at all. Prompt: Look into issue #713. Is it still relevant for the 3.3-series? [#713] Followup-Prompt: I think we may want a general workaround that can work without features specified (but the check and feature-flag for it was created in a parallell branch/pull request). "if no www-auth header given, no auth_type set, and TLS in place, try out basic auth". (sic) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>
tobixen
force-pushed
the
issue713-unprompted-basic-auth
branch
from
September 21, 2026 16:44
d686a91 to
b5ad480
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RFC 7235 section 3.1 requires a 401 to name an authentication scheme. Yahoo Calendar omits it entirely, so
_should_negotiate_authnever fires,build_auth_object()is never called, the credentials are never sent, and the bare 401 surfaces asAuthorizationErrorindistinguishable from a genuinely rejected password. This is a general fallback rather than a feature-flag-gated one, since a first-time connection to an unrecognised server has no compatibility hints to consult yet.Added
_should_attempt_unprompted_basic/_build_unprompted_basic_authin base_client.py, wired into both the sync and async request loops. The guess fires once, only over TLS, and only when neitherauth_typenorauthwas already configured (either would already have taken effect before this code path is reached). #715 documents the same server behaviour via compatibility_hints for known servers; this is the general, unconditional counterpart for servers with no profile at all.Prompt: Look into issue #713. Is it still relevant for the 3.3-series? [https://github.com//issues/713]
Followup-Prompt: I think we may want a general workaround that can work without features specified (but the check and feature-flag for it was created in a parallell branch/pull request). "if no www-auth header given, no auth_type set, and TLS in place, try out basic auth". (sic)
Reviewed-by: Tobias Brox tobias@redpill-linpro.com