GNU bug report logs - #35688
url-auth prompt is blank when realm is the empty string

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 35688 in the body.
You can then email your comments to 35688 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Thomas Fitzsimmons <fitzsim <at> fitzsim.org>
To: bug-gnu-emacs <at> gnu.org
Subject: url-auth prompt is blank when realm is the empty string
Date: Sat, 11 May 2019 16:38:27 -0400

Hi,

When a website returns an empty string for realm, url-get-authentication
prompts:

Username [for ]:

See for example:

(url-retrieve-synchronously "https://outlook.office365.com/EWS/Exchange.asmx")

The attached patch makes the prompt contain the full URL, and applies to
all auth schemes.  However, maybe each auth scheme should decide how to
handle a "" realm and to fix this particular case I should just change
url-basic-auth?  I'm open to suggestions.

Anyway, I'm filing this bug because I think prompting for a username and
password while not showing the user the requested URL is a usability
problem.

Thomas

diff --git a/lisp/url/url-auth.el b/lisp/url/url-auth.el
index 0746cfd96c..f644787cc6 100644
--- a/lisp/url/url-auth.el
+++ b/lisp/url/url-auth.el
@@ -478,6 +478,8 @@ url-get-authentication
        if one cannot be found in the cache"
   (if (not realm)
       (setq realm (cdr-safe (assoc "realm" args))))
+  (if (equal realm "")
+      (setq realm nil))
   (if (stringp url)
       (setq url (url-generic-parse-url url)))
   (if (or (null type) (eq type 'any))

Message #8 received at 35688 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Thomas Fitzsimmons <fitzsim <at> fitzsim.org>
Cc: 35688 <at> debbugs.gnu.org
Subject: Re: bug#35688: url-auth prompt is blank when realm is the empty string
Date: Wed, 15 May 2019 06:15:03 +0200

Thomas Fitzsimmons <fitzsim <at> fitzsim.org> writes:

> See for example:
>
> (url-retrieve-synchronously "https://outlook.office365.com/EWS/Exchange.asmx")
>
> The attached patch makes the prompt contain the full URL, and applies to
> all auth schemes.  However, maybe each auth scheme should decide how to
> handle a "" realm and to fix this particular case I should just change
> url-basic-auth?  I'm open to suggestions.
>
> Anyway, I'm filing this bug because I think prompting for a username and
> password while not showing the user the requested URL is a usability
> problem.

I think your fix sounds sufficient, so I've applied it to Emacs 27.1 as
is.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.