There are 4 comments.
 
 
XWiki Platform / cid:jira-generated-image-avatar-8bb1b2b2-5783-421a-9e76-acb693fea5a6 XWIKI-21879 Open

Force preemptive authentication in $xwiki.getURLContent()

 
View issue   ยท   Add comment
 

4 comments

 
cid:jira-generated-image-avatar-945df8ca-6083-438c-8e4a-949bc5f8c701 Leonid Lunin on 15/Nov/24 09:47
 

??I don't think it ignores them, but by default the HTTP client is sending the credentials when asked for them (when getting a 401).
??
I faced this issue when I was using the GitHub REST API in my wiki. I wanted to add my PAT to have an unlimited API access. If no PAT proviede - GitHub REST API does not responses with 401 but limit the amount of requests. I believe it also responses with 403 when trying get the info outside of the default access scope.

I believe that the method for request with the given credentials should use them if I have already provided them in function call. If I would like not to use credentials - I would rather use a function without credentials field. This behaviour now is confusing because you specify the credentials and except them to be applied. Why should I give the credentials and except them to be used only in case of 401?

 
cid:jira-generated-image-avatar-945df8ca-6083-438c-8e4a-949bc5f8c701 Leonid Lunin on 15/Nov/24 09:49
 
?? > I don't think it ignores them, but by default the HTTP client is sending the credentials when asked for them (when getting a [401|https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401]).
??
I faced this issue when I was using the GitHub REST API in my wiki. I wanted to add my PAT to have an unlimited API access. If no PAT proviede - GitHub REST API does not responses with 401 but limit the amount of requests. I believe it also responses with 403 when trying get the info outside of the default access scope.

I believe that the method for request with the given credentials should use them if I have already provided them in function call. If I would like not to use credentials - I would rather use a function without credentials field. This behaviour now is confusing because you specify the credentials and except them to be applied. Why should I give the credentials and except them to be used only in case of 401?
 
cid:jira-generated-image-avatar-e3901c05-9796-4715-a4b4-f54f9352fbd8 Thomas Mortagne on 15/Nov/24 09:51
 

I believe that the method for request with the given credentials should use them

It's not that simple, I gave more detail on the pull request on why HttpClient does not send the credential right away by default (in short, it's not really sure how exactly to send them).

 
cid:jira-generated-image-avatar-945df8ca-6083-438c-8e4a-949bc5f8c701 Leonid Lunin on 15/Nov/24 09:52
 
> I don't think it ignores them, but by default the HTTP client is sending the credentials when asked for them (when getting a [401|https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401]).

I faced this issue when I was using the GitHub REST API in my wiki. I wanted to add my PAT to have an unlimited API access. If no PAT
proviede provided - GitHub REST API does not responses with 401 but limit the amount of requests. I believe it also responses with 403 when trying get the info outside of the default access scope.

I believe that the method for request with the given credentials should use them if I have already provided them in function call. If I would like not to use credentials - I would rather use a function without credentials field. This behaviour now is confusing because you specify the credentials and except them to be applied. Why should I give the credentials and except them to be used only in case of 401?