100-continue and 401

[Nick Kew]

On 19 Mar 2013, at 12:31, Luka Perkov wrote:

> Hi all,
> 
> I'm using nginx as a frontend for my SCGI application and I want to
> handle authentication in my SCGI code. I have to deal with POST
> requests. Is it ok that nginx sends "401 Unauthorized" after sending
> "100 Continue"?
> 
> Are both requests bellow correct?
> 
> I'm asking because of this curl message: "HTTP error before end of send,
> stop sending".
> 
> Luka
> 
> $ curl -v -X POST -d "@/path/to/some/blob" http://127.0.0.1:8000/
> * About to connect() to 127.0.0.1 port 8000 (#0)
> *   Trying 127.0.0.1...
> * Connected to 127.0.0.1 (127.0.0.1) port 8000 (#0)
>> POST / HTTP/1.1
>> User-Agent: curl/7.29.0
>> Host: 127.0.0.1:8000
>> Accept: */*
>> Content-Length: 3398
>> Content-Type: application/x-www-form-urlencoded
>> Expect: 100-continue

That's OK.
>> 
> < HTTP/1.1 100 Continue
> < HTTP/1.1 401 Unauthorized

That's not OK.  It would need at least a blank line between
those two to make an intermediate and a final response
(without that it's broken).
The server should also wait for the payload it's just invited,
but perhaps the client didn't wait before sending it?

> < Server: nginx/1.3.14
> < Date: Tue, 19 Mar 2013 12:11:16 GMT
> < Transfer-Encoding: chunked
> < Connection: keep-alive
> < WWW-Authenticate: Basic realm="bla-bla-bla"

That's all in order in the final (401) response.

>> POST / HTTP/1.1
>> User-Agent: curl/7.29.0
>> Host: 127.0.0.1:8000
>> Accept: */*
>> Content-Length: 0
>> Content-Type: application/x-www-form-urlencoded

That's also OK.

> < HTTP/1.1 401 Unauthorized
> < Server: nginx/1.3.14
> < Date: Tue, 19 Mar 2013 12:23:17 GMT
> < Transfer-Encoding: chunked
> < Connection: keep-alive
> < WWW-Authenticate: Basic realm="bla-bla-bla"

That's OK so long as it sends the (chunked) response promised.

> * HTTP error before end of send, stop sending
> < 
> * Closing connection 0

… but the client thinks it didn't.  Whoops!

How much of those responses are being generated by your app?
I'd expect the server to take care of protocol issues like the
intermediate response and chunked encoding - unless your app
disables it!

-- 
Nick Kew