Status: New
Owner: ----
Labels: Type-Defect Priority-Medium

New issue 2656 by 401 loop when trying to reach a Web API page on a site protected by Apache's mod_auth_basic

* NOTE: Do not post confidential information in this bug report. *
*       If you need immediate support, please contact            *
*                             *

What version are you running?
- Review Board 1.6.9, RBTools 0.4.1

What's the URL of the page containing the problem?
- (Web API) /api/*

What steps will reproduce the problem?
What is the expected output? What do you see instead?
- I ran into this issue while testing the post-review app (tried it with --username, --password, --http-username and --http-password all filled out correctly).

- I then tried to reach an API page directly from my browser (e.g. https://DOMAIN/api/review-requests/1/). 1. When I first reach the page, I'm greeted with a Basic Auth popup, with the realm showing up as the one I'd configured on my server. 2. After submitting my auth credentials, I get a second popup, this time with "Web API" showing up as the realm. 3. At this point, I enter my ReviewBoard site admin user/pass to log in. Rather than reaching the page, I end up back at the previous auth popup. 4. In short, I just keep hitting 401s back and forth (checked Apache logs to confirm).

- If I disable side-wide auth, it works (see logs below).

What operating system are you using? What browser?
- RB is set up on Ubuntu 10.04; I tried post-review on both Windows 7 and Ubuntu. Browser is Chrome on Windows.

Please provide any additional information below.
- Some logs:
HTTP GETting api/
HTTP GETting https://DOMAIN/api/review-requests/1/
Got API Error 103 (HTTP code 401): You are not logged in
Error data: {u'stat': u'fail', u'err': {u'msg': u'You are not logged in', u'code': 103}}
DOMAIN:443 - - [01/Jul/2012:04:41:57 +0000] "GET /api/ HTTP/1.1" 401 5365 "-" "Python-urllib/2.6" DOMAIN:443 - MyAuthUser [01/Jul/2012:04:41:57 +0000] "GET /api/ HTTP/1.1" 200 10309 "-" "Python-urllib/2.6" DOMAIN:443 - - [01/Jul/2012:04:41:58 +0000] "GET /api/review-requests/1/ HTTP/1.1" 401 5365 "-" "Python-urllib/2.6" DOMAIN:443 - MyAuthUser [01/Jul/2012:04:41:59 +0000] "GET /api/review-requests/1/ HTTP/1.1" 401 5285 "-" "Python-urllib/2.6"

- Logs with site-wide auth disabled:
HTTP GETting api/
HTTP GETting https://DOMAIN/api/review-requests/1/
DOMAIN:443 - - [01/Jul/2012:04:49:57 +0000] "GET /api/ HTTP/1.1" 200 10181 "-" "Python-urllib/2.6" DOMAIN:443 - - [01/Jul/2012:04:49:58 +0000] "GET /api/review-requests/1/ HTTP/1.1" 401 5157 "-" "Python-urllib/2.6" DOMAIN:443 - - [01/Jul/2012:04:49:59 +0000] "GET /api/review-requests/1/ HTTP/1.1" 200 7029 "-" "Python-urllib/2.6"

- Other:
WSGIPassAuthorization is set to On.

Any help would be greatly appreciated!

You received this message because you are subscribed to the Google Groups 
"reviewboard-issues" group.
To post to this group, send email to
To unsubscribe from this group, send email to
For more options, visit this group at

Reply via email to