From: Georg Brandl <georg@python.org>
Date: Wed, 7 Mar 2007 07:39:13 +0000 (+0000)
Subject: Patch #812285: allow multiple auth schemes in AbstractBasicAuthHandler.
X-Git-Tag: v2.5.1c1~79
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=fd13ef9c9c6df46143a2d1d28e7ac6063158fb23;p=python

Patch #812285: allow multiple auth schemes in AbstractBasicAuthHandler.
 (backport from rev. 54195)
---

diff --git a/Lib/urllib2.py b/Lib/urllib2.py
index 1ab5c61454..4e926a154b 100644
--- a/Lib/urllib2.py
+++ b/Lib/urllib2.py
@@ -766,11 +766,10 @@ class HTTPPasswordMgrWithDefaultRealm(HTTPPasswordMgr):
 
 class AbstractBasicAuthHandler:
 
-    rx = re.compile('[ \t]*([^ \t]+)[ \t]+realm="([^"]*)"', re.I)
+    # XXX this allows for multiple auth-schemes, but will stupidly pick
+    # the last one with a realm specified.
 
-    # XXX there can actually be multiple auth-schemes in a
-    # www-authenticate header.  should probably be a lot more careful
-    # in parsing them to extract multiple alternatives
+    rx = re.compile('(?:.*,)*[ \t]*([^ \t]+)[ \t]+realm="([^"]*)"', re.I)
 
     # XXX could pre-emptively send auth info already accepted (RFC 2617,
     # end of section 2, and section 1.2 immediately after "credentials"