Score: 62
Score: 64
Score: 64
Score: 64
Score: 71
Score: 78
Score: 86
Score: 72
Please send feedback to julian.reschke@gmx.de.
Note that several aspects of WWW-Authenticate are currently under discussions which may cause the "expected" results to change (for instance, the requirement for the realm parameter, the requirement to have at least a single parameter, the use of whitespace around the assignment, and the requirement to use quoted-string for realm values). Please join the IETF HTTPbis WG's mailing list to participate.
Furthermore, there's also a new IETF HTTPAuth Working Group, working on updating the specs for Basic and Digest (among other things). See the WG's home page for details.
Unless stated otherwise, all tests were executed with the latest release versions of Firefox, Google Chrome, Microsoft Internet Explorer (both 8 & 9 as IE9 is not available for XP), Safari and Opera on a machine running Windows 7. Konqueror was tested on OpenSuse 11.4. Test versions are included when there was a change related to the test cases.
Colors -- Red: Failure, Green: Pass, Yellow: Warning, Grey: Not Supported
Score -- Passes: 2 points, Warning: 1 point, in percent of possible points (this should be updated to count optional features differently)
| Test Case | Firefox 21 | Microsoft IE 8 | Microsoft IE 9 | Microsoft IE 10 | Opera 12.14 | Safari 5.1 | Konqueror 4.8.4 | Google Chrome 25 | |
|---|---|---|---|---|---|---|---|---|---|
| Summary | Score: 62 | Score: 64 | Score: 64 | Score: 64 | Score: 71 | Score: 78 | Score: 86 | Score: 72 | |
| Basic | simplebasic | pass | pass | pass | pass | pass | pass | ||
| simplebasiclf | pass | fail (Doesn't see the realm parameter) | pass | pass | pass | pass | |||
| simplebasicucase | pass | pass | pass | pass | fail (misses the realm parameter) | pass | |||
| simplebasictok | warn (accepts the unquoted form) | warn (accepts the unquoted form) | warn (accepts the unquoted form) | warn (accepts the unquoted form) | warn (accepts the unquoted form) | warn (accepts the unquoted form) | |||
| simplebasictokbs | warn (accepts the unquoted form) | warn (accepts the unquoted form) | warn (accepts the unquoted form) | pass (ignores the challenge) | warn (accepts the unquoted form) | warn (accepts the unquoted form) | |||
| simplebasicsq | warn (detects realm 'foo') | warn (detects realm 'foo') | warn (detects realm 'foo') | warn (detects realm 'foo') | warn (detects realm 'foo') | fail (detects realm foo) | |||
| simplebasicpct | pass | pass | pass | pass | pass | pass | |||
| simplebasiccomma | pass | pass | pass | pass | pass | pass | |||
| simplebasiccomma2 | pass (ignores the header field) | pass (ignores the header field) | pass (ignores the header field) | warn (accepts the header field) | pass (ignores the header field) | pass (ignores the header field) | |||
| simplebasicnorealm | warn (accepts the realm-less form) | warn (accepts the realm-less form (shows "(null") realm)) | warn (accepts the realm-less form) | warn (accepts the realm-less form, derives the presented value from the host name) | warn (accepts the realm-less form, derives the presented value from the host name) | warn (accepts the realm-less form) | |||
| simplebasic2realms | warn (takes the first realm) | warn (takes the first realm) | warn (takes the first realm) | warn (takes the second realm) | warn (takes the first realm) | warn (takes the second realm) | |||
| simplebasicwsrealm | pass | warn (accepts the whitespace) | pass | warn (accepts the whitespace) | pass | warn (accepts the whitespace) | |||
| simplebasicrealmsqc | fail (fails to unescape, thus sees the realm \f\o\o (see Mozilla Bug 676358)) | fail (fails to unescape, thus sees the realm \f\o\o) | fail (fails to unescape, thus sees the realm \f\o\o) | fail (fails to unescape, thus sees the realm \f\o\o) | pass | pass | |||
| simplebasicrealmsqc2 | fail (fails to unescape, thus sees the realm "\foo\" (see Mozilla Bug 676358)) | fail (fails to unescape, thus sees the realm "\foo\") | fail (fails to unescape, thus sees the realm "\foo\") | fail (fails to unescape, thus sees the realm "\foo\") | pass | pass | |||
| simplebasicnewparam1 | pass | pass | pass | pass | pass | pass | |||
| simplebasicnewparam2 | pass | pass | pass | pass | pass | pass | |||
| simplebasicrealmiso88591 | pass | pass | pass | pass | pass | pass | |||
| simplebasicrealmutf8 | pass (displayed as the two raw characters ä) | pass (displayed as the two raw characters ä) | pass (displayed as the two raw characters ä) | pass (displayed as the two raw characters ä) | pass (displayed as the two raw characters ä) | pass (displayed as the two raw characters ä) | |||
| simplebasicrealmrfc2047 | pass | pass | pass | pass | pass | pass | |||
| Multiple Challenges | multibasicunknown | pass | pass | pass | pass | pass | pass | ||
| multibasicunknown2 | fail (doesn't see the Basic challenge (see Mozilla Bug 669675)) | fail (doesn't see the Basic challenge) | fail (doesn't see the Basic challenge) | pass | pass | fail (doesn't see the Basic challenge (see Chrome Issue 103220)) | |||
| multibasicunknown2mf | pass | pass | pass | pass | pass | pass | |||
| multibasicempty | fail (doesn't see the Basic challenge (likely the same as Mozilla Bug 669675)) | fail (doesn't see the Basic challenge) | fail (doesn't see the Basic challenge) | fail (doesn't see the Basic challenge) | pass | fail (doesn't see the Basic challenge) | |||
| multibasicqs | fail (doesn't see the Basic challenge (likely the same as Mozilla Bug 669675)) | fail (doesn't see the Basic challenge) | fail (doesn't see the Basic challenge) | pass | pass | fail (doesn't see the Basic challenge) | |||
| multidisgscheme | fail (doesn't see the Basic challenge (likely the same as Mozilla Bug 669675)) | fail (doesn't see the Basic challenge) | fail (doesn't see the Basic challenge) | pass | pass | fail (doesn't see the Basic challenge) | |||
| Unknown Schemes | unknown | pass (Page is displayed, no prompt) | pass (Page is displayed, no prompt) | pass (Page is displayed, no prompt) | pass (Page is displayed, no prompt) | pass (Page is displayed, no prompt) | pass (Page is displayed, no prompt) | ||
| Parsing quirks | disguisedrealm | fail (detects realm nottherealm",) | pass | pass | pass | pass | pass | ||
| disguisedrealm2 | fail (detects realm nottherealm) | pass | pass | pass | pass | pass | |||
| missingquote | warn (detects realm basic) | warn (detects realm basic) | pass (ignores the challenge) | warn (detects realm basic) | warn (detects Basic challenge with no realm) | warn (detects realm basic) | |||
Various tests checking Basic auth.
WWW-Authenticate: Basic realm="foo"
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
simple Basic auth
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "foo" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | foo |
WWW-Authenticate: Basic realm="foo"
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | fail (Doesn't see the realm parameter) |
| MSIE9 | fail (Doesn't see the realm parameter) |
| MSIE10 | fail (Doesn't see the realm parameter) |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
simple Basic auth, with (deprecated) line folding
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "foo" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | foo |
WWW-Authenticate: BASIC REALM="foo"
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | fail (misses the realm parameter) |
| Chr25 | pass |
simple Basic auth (using uppercase characters)
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| BASIC | REALM | "foo" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | foo |
WWW-Authenticate: Basic realm=foo
| Test Results | |
|---|---|
| FF19 | warn (accepts the unquoted form) |
| MSIE8 | warn (accepts the unquoted form) |
| MSIE9 | warn (accepts the unquoted form) |
| MSIE10 | warn (accepts the unquoted form) |
| Opera | warn (accepts the unquoted form) |
| Safari | warn (accepts the unquoted form) |
| Konq | warn (accepts the unquoted form) |
| Chr25 | warn (accepts the unquoted form) |
simple Basic auth, using token format for realm (but see Section 2.2 of draft-ietf-httpbis-p7-auth-22)
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | foo |
Invalid syntax: parameter 'realm' is defined to only use 'quoted-string' syntax.
WWW-Authenticate: Basic realm=\f\o\o
^ (PARSE ERROR)
| Test Results | |
|---|---|
| FF19 | warn (accepts the unquoted form) |
| MSIE8 | warn (accepts the unquoted form) |
| MSIE9 | warn (accepts the unquoted form) |
| MSIE10 | warn (accepts the unquoted form) |
| Opera | warn (accepts the unquoted form) |
| Safari | pass (ignores the challenge) |
| Konq | warn (accepts the unquoted form) |
| Chr25 | warn (accepts the unquoted form) |
simple Basic auth, using token format for realm (but see Section 2.2 of draft-ietf-httpbis-p7-auth-22), including backslashes
WWW-Authenticate: Basic realm='foo'
| Test Results | |
|---|---|
| FF19 | warn (detects realm 'foo') |
| MSIE8 | warn (detects realm 'foo') |
| MSIE9 | warn (detects realm 'foo') |
| MSIE10 | warn (detects realm 'foo') |
| Opera | warn (detects realm 'foo') |
| Safari | warn (detects realm 'foo') |
| Konq | warn (detects realm 'foo') |
| Chr25 | fail (detects realm foo) |
simple Basic auth, using single quotes (these are allowed in a token, but should not be treated as quote characters)
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | 'foo' |
Invalid syntax: parameter 'realm' is defined to only use 'quoted-string' syntax.
WWW-Authenticate: Basic realm="foo%20bar"
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
simple Basic auth, containing a %-escape (which isn't special here)
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "foo%20bar" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | foo%20bar |
WWW-Authenticate: Basic , realm="foo"
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
simple Basic auth, with a comma between schema and auth-param
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "foo" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | foo |
WWW-Authenticate: Basic, realm="foo"
^ (PARSE ERROR)
| Test Results | |
|---|---|
| FF19 | pass (ignores the header field) |
| MSIE8 | pass (ignores the header field) |
| MSIE9 | pass (ignores the header field) |
| MSIE10 | pass (ignores the header field) |
| Opera | pass (ignores the header field) |
| Safari | warn (accepts the header field) |
| Konq | pass (ignores the header field) |
| Chr25 | pass (ignores the header field) |
simple Basic auth, with a comma between schema and auth-param (this is invalid because of the missing space characters after the scheme name)
WWW-Authenticate: Basic
^ (PARSE ERROR)
| Test Results | |
|---|---|
| FF19 | warn (accepts the realm-less form) |
| MSIE8 | warn (accepts the realm-less form (shows "(null") realm)) |
| MSIE9 | warn (accepts the realm-less form (shows "(null") realm)) |
| MSIE10 | warn (accepts the realm-less form (shows "(null") realm)) |
| Opera | warn (accepts the realm-less form) |
| Safari | warn (accepts the realm-less form, derives the presented value from the host name) |
| Konq | warn (accepts the realm-less form, derives the presented value from the host name) |
| Chr25 | warn (accepts the realm-less form) |
simple Basic auth, realm parameter missing
WWW-Authenticate: Basic realm="foo", realm="bar"
| Test Results | |
|---|---|
| FF19 | warn (takes the first realm) |
| MSIE8 | warn (takes the first realm) |
| MSIE9 | warn (takes the first realm) |
| MSIE10 | warn (takes the first realm) |
| Opera | warn (takes the first realm) |
| Safari | warn (takes the second realm) |
| Konq | warn (takes the first realm) |
| Chr25 | warn (takes the second realm) |
simple Basic auth with two realm parameters
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "foo" |
| realm | "bar" |
Invalid syntax: parameter 'realm' needs to appear exactly once for 'basic' challenge.
WWW-Authenticate: Basic realm = "foo"
^ (PARSE ERROR)
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | warn (accepts the whitespace) |
| MSIE9 | warn (accepts the whitespace) |
| MSIE10 | warn (accepts the whitespace) |
| Opera | pass |
| Safari | warn (accepts the whitespace) |
| Konq | pass |
| Chr25 | warn (accepts the whitespace) |
simple Basic auth, whitespace used in auth-param assignment (but see HTTPbis WG Ticket 287)
WWW-Authenticate: Basic realm="\f\o\o"
| Test Results | |
|---|---|
| FF19 | fail (fails to unescape, thus sees the realm \f\o\o (see Mozilla Bug 676358)) |
| MSIE8 | fail (fails to unescape, thus sees the realm \f\o\o) |
| MSIE9 | fail (fails to unescape, thus sees the realm \f\o\o) |
| MSIE10 | fail (fails to unescape, thus sees the realm \f\o\o) |
| Opera | fail (fails to unescape, thus sees the realm \f\o\o) |
| Safari | fail (fails to unescape, thus sees the realm \f\o\o) |
| Konq | pass |
| Chr25 | pass |
simple Basic auth, with realm using quoted string escapes
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "\f\o\o" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | foo |
WWW-Authenticate: Basic realm="\"foo\""
| Test Results | |
|---|---|
| FF19 | fail (fails to unescape, thus sees the realm "\foo\" (see Mozilla Bug 676358)) |
| MSIE8 | fail (fails to unescape, thus sees the realm "\foo\") |
| MSIE9 | fail (fails to unescape, thus sees the realm "\foo\") |
| MSIE10 | fail (fails to unescape, thus sees the realm "\foo\") |
| Opera | fail (fails to unescape, thus sees the realm "\foo\") |
| Safari | fail (fails to unescape, thus sees the realm "\foo\") |
| Konq | pass |
| Chr25 | pass |
simple Basic auth, with realm using quoted string escapes
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "\"foo\"" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | "foo" |
WWW-Authenticate: Basic realm="foo", bar="xyz",, a=b,,,c=d
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
simple Basic auth, with additional auth-params
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "foo" |
| bar | "xyz" | |
| a | b | |
| c | d |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | foo |
| bar | xyz | |
| a | b | |
| c | d |
WWW-Authenticate: Basic bar="xyz", realm="foo"
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
simple Basic auth, with an additional auth-param (but with reversed order)
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | bar | "xyz" |
| realm | "foo" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | bar | xyz |
| realm | foo |
WWW-Authenticate: Basic realm="foo-ä"
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
simple Basic auth, using "a umlaut" character encoded using ISO-8859-1
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "foo-ä" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | foo-ä |
WWW-Authenticate: Basic realm="foo-ä"
| Test Results | |
|---|---|
| FF19 | pass (displayed as the two raw characters ä) |
| MSIE8 | pass (displayed as the two raw characters ä) |
| MSIE9 | pass (displayed as the two raw characters ä) |
| MSIE10 | pass (displayed as the two raw characters ä) |
| Opera | pass (displayed as the two raw characters ä) |
| Safari | pass (displayed as the two raw characters ä) |
| Konq | pass (displayed as the two raw characters ä) |
| Chr25 | pass (displayed as the two raw characters ä) |
simple Basic auth, using "a umlaut" character encoded using UTF-8
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "foo-ä" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | foo-ä |
WWW-Authenticate: Basic realm="=?ISO-8859-1?Q?foo-=E4?="
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
simple Basic auth, using "a umlaut" character encoded using RFC 2047
RFC 2047 does not apply to quoted-strings, so the realm really is =?ISO-8859-1?Q?foo-=E4?=
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "=?ISO-8859-1?Q?foo-=E4?=" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | =?ISO-8859-1?Q?foo-=E4?= |
Various tests checking multiple challenges.
WWW-Authenticate: Basic realm="basic", Newauth realm="newauth"
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
a header field containing two challenges, one of which unknown
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "basic" |
| scheme name | parameter name | parameter value |
|---|---|---|
| Newauth | realm | "newauth" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | basic |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| newauth | realm | newauth |
WWW-Authenticate: Newauth realm="newauth", Basic realm="basic"
| Test Results | |
|---|---|
| FF19 | fail (doesn't see the Basic challenge (see Mozilla Bug 669675)) |
| MSIE8 | fail (doesn't see the Basic challenge) |
| MSIE9 | fail (doesn't see the Basic challenge) |
| MSIE10 | fail (doesn't see the Basic challenge) |
| Opera | fail (doesn't see the Basic challenge) |
| Safari | pass |
| Konq | pass |
| Chr25 | fail (doesn't see the Basic challenge (see Chrome Issue 103220)) |
as above, but with challenges swapped
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Newauth | realm | "newauth" |
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "basic" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| newauth | realm | newauth |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | basic |
WWW-Authenticate: Newauth realm="newauth" WWW-Authenticate: Basic realm="basic"
| Test Results | |
|---|---|
| FF19 | pass |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
as above, but using two header fields
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Newauth | realm | "newauth" |
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "basic" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| newauth | realm | newauth |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | basic |
WWW-Authenticate: ,Basic realm="basic"
| Test Results | |
|---|---|
| FF19 | fail (doesn't see the Basic challenge (likely the same as Mozilla Bug 669675)) |
| MSIE8 | fail (doesn't see the Basic challenge) |
| MSIE9 | fail (doesn't see the Basic challenge) |
| MSIE10 | fail (doesn't see the Basic challenge) |
| Opera | fail (doesn't see the Basic challenge) |
| Safari | fail (doesn't see the Basic challenge) |
| Konq | pass |
| Chr25 | fail (doesn't see the Basic challenge) |
a header field containing one Basic challenge, following an empty one
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "basic" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | basic |
WWW-Authenticate: Newauth realm="apps", type=1, title="Login to \"apps\"", Basic realm="simple"
| Test Results | |
|---|---|
| FF19 | fail (doesn't see the Basic challenge (likely the same as Mozilla Bug 669675)) |
| MSIE8 | fail (doesn't see the Basic challenge) |
| MSIE9 | fail (doesn't see the Basic challenge) |
| MSIE10 | fail (doesn't see the Basic challenge) |
| Opera | fail (doesn't see the Basic challenge) |
| Safari | pass |
| Konq | pass |
| Chr25 | fail (doesn't see the Basic challenge) |
a header field containing two challenges, the first one for a new scheme and having a parameter using quoted-string syntax
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Newauth | realm | "apps" |
| type | 1 | |
| title | "Login to \"apps\"" |
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "simple" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| newauth | realm | apps |
| type | 1 | |
| title | Login to "apps" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | simple |
WWW-Authenticate: Newauth realm="Newauth Realm", basic=foo, Basic realm="Basic Realm"
| Test Results | |
|---|---|
| FF19 | fail (doesn't see the Basic challenge (likely the same as Mozilla Bug 669675)) |
| MSIE8 | fail (doesn't see the Basic challenge) |
| MSIE9 | fail (doesn't see the Basic challenge) |
| MSIE10 | fail (doesn't see the Basic challenge) |
| Opera | fail (doesn't see the Basic challenge) |
| Safari | pass |
| Konq | pass |
| Chr25 | fail (doesn't see the Basic challenge) |
a header field containing two challenges, the first one for a new scheme and having a parameter called "Basic"
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Newauth | realm | "Newauth Realm" |
| basic | foo |
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | realm | "Basic Realm" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| newauth | realm | Newauth Realm |
| basic | foo |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | realm | Basic Realm |
Tests for how unknown schemes are handled.
WWW-Authenticate: Newauth realm="newauth"
| Test Results | |
|---|---|
| FF19 | pass (Page is displayed, no prompt) |
| MSIE8 | pass (Page is displayed, no prompt) |
| MSIE9 | pass (Page is displayed, no prompt) |
| MSIE10 | pass (Page is displayed, no prompt) |
| Opera | pass (Page is displayed, no prompt) |
| Safari | pass (Page is displayed, no prompt) |
| Konq | pass (Page is displayed, no prompt) |
| Chr25 | pass (Page is displayed, no prompt) |
a header field containing a challenge for an unknown scheme
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Newauth | realm | "newauth" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| newauth | realm | newauth |
Tests for how tricky header fields are parsed.
WWW-Authenticate: Basic foo="realm=nottherealm", realm="basic"
| Test Results | |
|---|---|
| FF19 | fail (detects realm nottherealm",) |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
a header field containing a Basic challenge, with a quoted-string extension param that happens to contain the string "realm="
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | foo | "realm=nottherealm" |
| realm | "basic" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | foo | realm=nottherealm |
| realm | basic |
WWW-Authenticate: Basic nottherealm="nottherealm", realm="basic"
| Test Results | |
|---|---|
| FF19 | fail (detects realm nottherealm) |
| MSIE8 | pass |
| MSIE9 | pass |
| MSIE10 | pass |
| Opera | pass |
| Safari | pass |
| Konq | pass |
| Chr25 | pass |
a header field containing a Basic challenge, with a preceding extension param named "nottherealm"
Extracted raw data:
| scheme name | parameter name | parameter value |
|---|---|---|
| Basic | nottherealm | "nottherealm" |
| realm | "basic" |
After post-processing the authentication scheme name, parameter names, and parameter values:
| scheme name | parameter name | parameter value |
|---|---|---|
| basic | nottherealm | nottherealm |
| realm | basic |
WWW-Authenticate: Basic realm="basic
^ (PARSE ERROR)
| Test Results | |
|---|---|
| FF19 | warn (detects realm basic) |
| MSIE8 | warn (detects realm basic) |
| MSIE9 | warn (detects realm basic) |
| MSIE10 | warn (detects realm basic) |
| Opera | pass (ignores the challenge) |
| Safari | warn (detects realm basic) |
| Konq | warn (detects Basic challenge with no realm) |
| Chr25 | warn (detects realm basic) |
a header field containing a Basic challenge, with a realm missing the second double quote
Both this document and the indiviual test "scripts" are generated from one single XML source (httpauth.xml), using an XSLT2 transformation (httpauth.xslt).
To generate the files, an XSLT2 processor such as Saxon 9 is needed. Copy both files into an empty directory, then run:
saxon9 httpauth.xml httpauth.xslt > index.html
Note that this will also generate a set of "*.asis" and "nph-*.cgi" files that contain the actual test cases. The "*.asis" files need to be served using the Apache httpd mod_asis module.