Re: Authentication Issue

2010-09-22 Thread Justin Edelson
I commented on the code inline, but to clarify here, what I was trying to suggest below is to ignore the request method and *only* using the Accepts header. To me, the logic I think we should be expressing is: if (isBrowserRequest(request)) { if (isAjaxRequest(request)) {

Re: Authentication Issue

2010-09-22 Thread Justin Edelson
BTW, for WebDAV clients, I tested on Ubuntu 10.04/Gnome VFS and OS X 10.6.4/Finder. On Wed, Sep 22, 2010 at 12:39 PM, Justin Edelson justinedel...@gmail.com wrote: I commented on the code inline, but to clarify here, what I was trying to suggest below is to ignore the request method and *only*

Re: Authentication Issue

2010-09-22 Thread Felix Meschberger
Hi, Ok, sounds reasonable, I will do it like this. Thanks alot. Regards Felix Am 22.09.2010 18:39, schrieb Justin Edelson: I commented on the code inline, but to clarify here, what I was trying to suggest below is to ignore the request method and *only* using the Accepts header. To me,

Re: Authentication Issue

2010-09-22 Thread Felix Meschberger
Hi, Am 22.09.2010 19:14, schrieb Justin Edelson: BTW, for WebDAV clients, I tested on Ubuntu 10.04/Gnome VFS and OS X 10.6.4/Finder. Thanks, will add the OS X finder to the list of tested clients in the javadoc. Regards Felix On Wed, Sep 22, 2010 at 12:39 PM, Justin Edelson

Re: Authentication Issue

2010-09-21 Thread Felix Meschberger
Hi, Ok, I have uploaded another patch with two methods to check for WebDAV initial request and Ajax request. I for now left out any more intense Accepts header testing since none of the WebDAV clients I tested with (see JavaDoc) sent an Accepts header at all. I also ommited adding a header with

Re: Authentication Issue

2010-09-20 Thread Felix Meschberger
Hi, Am 17.09.2010 23:48, schrieb Ian Boston: On 18 Sep 2010, at 00:59, Felix Meschberger wrote: Hi all, I am trying to tackle issues SLING-1400 [1] and SLING-1745 [2]. The first issue is about WebDAV clients connecting to Sling on root with an OPTIONS request and not being happy with a

Re: Authentication Issue

2010-09-20 Thread Felix Meschberger
Hi all, I have uploaded a proposed patch including support for both issues to http://codereview.appspot.com/2192046/. Please comment. Thanks. Regards Felix Am 17.09.2010 16:59, schrieb Felix Meschberger: Hi all, I am trying to tackle issues SLING-1400 [1] and SLING-1745 [2]. The first

Re: Authentication Issue

2010-09-20 Thread Felix Meschberger
Hi, Am 20.09.2010 17:16, schrieb Justin Edelson: Two comments: 1) As mentioned, I think we should use the Accepts header instead of specifically checking for the OPTIONS method and return a 401 response unless the Accepts header is included in the request and *explicitly* contains

Re: Authentication Issue

2010-09-20 Thread Justin Edelson
On 9/20/10 1:56 PM, Felix Meschberger wrote: Hi, Am 20.09.2010 17:16, schrieb Justin Edelson: Two comments: 1) As mentioned, I think we should use the Accepts header instead of specifically checking for the OPTIONS method and return a 401 response unless the Accepts header is included in

Re: Authentication Issue

2010-09-20 Thread Ian Boston
On 21 Sep 2010, at 00:19, Felix Meschberger wrote: Hi all, I have uploaded a proposed patch including support for both issues to http://codereview.appspot.com/2192046/. Please comment. Thanks. The patch addresses all my earlier concerns with Ajax calls, thank you. I can see that Justin

Re: Authentication Issue

2010-09-18 Thread Felix Meschberger
Hi, Am 17.09.2010 18:09, schrieb Justin Edelson: At least in the WebDAV case, is there any way to use the Accepts header to help with making the decision as to how to respond? i.e. if Accepts contains text/html, return the login page. If it doesn't, return a 401. Perhaps this requires more

Authentication Issue

2010-09-17 Thread Felix Meschberger
Hi all, I am trying to tackle issues SLING-1400 [1] and SLING-1745 [2]. The first issue is about WebDAV clients connecting to Sling on root with an OPTIONS request and not being happy with a redirect response, obviously. The second issue is about client side JavaScript application framework

Re: Authentication Issue

2010-09-17 Thread Justin Edelson
At least in the WebDAV case, is there any way to use the Accepts header to help with making the decision as to how to respond? i.e. if Accepts contains text/html, return the login page. If it doesn't, return a 401. Perhaps this requires more testing of WebDAV clients than we can effectively do,

Re: Authentication Issue

2010-09-17 Thread Ian Boston
On 18 Sep 2010, at 00:59, Felix Meschberger wrote: Hi all, I am trying to tackle issues SLING-1400 [1] and SLING-1745 [2]. The first issue is about WebDAV clients connecting to Sling on root with an OPTIONS request and not being happy with a redirect response, obviously. The second