https://issues.apache.org/bugzilla/show_bug.cgi?id=44626
Summary: mod_auth fails on IE when script arguments present
Product: Apache httpd-2
Version: 2.2.6
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: P2
Component: mod_auth
AssignedTo: [email protected]
ReportedBy: [EMAIL PROTECTED]
When I use mod_auth to secure a page, IE (v6.0.29) appears to only send the
base URI for authentication, in other words, it doesn't include any script
arguments in the URI. The result is an Error 400 page and inability to access
these pages from IE. The relavant line in error_log is:
[Tue Mar 18 11:30:59 2008] [error] [client 128.197.164.239] Digest: uri
mismatch - </private/photoalb/test.php> does not match request-uri
</private/photoalb/test.php?ig=0&action=generateThumbnailList>, referer:
http://bmearns.net/private/photoalb/test.php
I realize this is actually probably a bug with Internet Explorer, but I think
it would probably be any easy fix to accomodate MicroSloth's defficincies. I
don't know the details of the authorization scheme, so I don't know if a fix
like this (essentially allowing mod_auth to ignore differences in URL script
arguments) would be compromising security or not.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
