Details
-
Bug
-
Status: Closed
-
Major
-
Resolution: Fixed
-
Auth Core 1.0.0
-
None
Description
The HTTP Authenticator included with the Commons Auth bundle currently does not behave well with respect to logging out and requesting credentials:
(1) sling:authRequestLogin parameter
The sling:authRequestLogin parameter should be supported with both values BASIC (for new mechanism) and 1 for backwards compatibility. Setting the parameter should always cause a 401 response from the authentication handler
(2) sendUnauthorized
The method should not do anything (except logging) if called on a committed response
(3) dropCredentials
The dropCredentials method should always send a 401 response if the Authorization header is set in the response and the response has not been committed yet.