If Apache is used to perform authentication, the Authorization header still gets
passed through to mod_python.publisher. Unfortunately, mod_python.publisher
authentication code in process_auth() will attempt to decode the contents of the
Authorization header even if there are no __auth__ or __access__ hooks defined
for authentication and access control within the published code itself.
The consequence of this is that if Digest authentication is used for AuthType
at level of Apache authentication, the process_auth() code will raise a bad request
error as it assumes Authorization header is always in format for Basic authentication
type and when it can't decode it, it raises an error.
What should happen is that any decoding of Authorization should only be done
if there is a __auth__ or __access__ hook that actually requires it. That way, if some
one uses Digest authentication at Apache configuration file level, provided that no
__auth__ or __access__ hooks are provided, there wouldn't be a problem.
See:
http://www.modpython.org/pipermail/mod_python/2005-April/017911.html
http://www.modpython.org/pipermail/mod_python/2005-April/017912.html
for additional information.
Bug
Closed
Minor
Digest Authorization header causes bad request error.
