do not send www-authenticate basic for Api requests

[micbar]

Description

Bugfix: Fix authenticate headers for API requests

We changed the www-authenticate header which should not be sent for "basic-auth" when the XMLHttpRequest header is set.

Related Issue

Fixes #5986

Motivation and Context

How Has This Been Tested?

• test environment:
• test case 1:
• test case 2:
• ...

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:

[ownclouders]

💥 Acceptance test localApiTests-apiSpacesShares-ocis failed. Further test are cancelled...

[dschmidt]

Thanks for tackling this!

Just a few comments/questsions:
a) Why is this only relevent for basic auth?
b) The header is X-Requested-With and the value is XmlHttpRequest
c) There is no regression test

[micbar]

a) Why is this only relevent for basic auth?
I am aware that the desktop client always checks the presence of the Www-authenticate header for bearer auth.

But we can completely not show any www-authenticate headers if ok for the clients.

b) The header is X-Requested-With and the value is XmlHttpRequest

Thanks. Will fix

c) we can do an API test. Let us tackle that separately.

[dschmidt]

a) Why is this only relevent for basic auth?
I am aware that the desktop client always checks the presence of the Www-authenticate header for bearer auth.

But we can completely not show any www-authenticate headers if ok for the clients.

Ah, interesting - from oC Web prespective: the www-authenticate header triggers a super annoying auth popup which we cannot surpress, so it would be great to avoid it completely ... and we don't use basic auth, so basically doing the check only for basic auth it kind of defeats the purpose of the issue we raised in the first place.

b) The header is X-Requested-With and the value is XmlHttpRequest

Thanks. Will fix

💪🏻

c) we can do an API test. Let us tackle that separately.

Yup, fine with me - I would just highly appreciate a regression test as it's so annoying in oC Web if for whatever reason a token refresh fails or some other condition leads to invalid tokens

[kobergj]

Now I get no Www-Authenticate header at all. Not Basic and also not Bearer.

Is this the intended behaviour?

[micbar]

Now I get no Www-Authenticate header at all. Not Basic and also not Bearer.

Is this the intended behaviour?

If you are sending 'x-requested-with: XMLHttpRequest' you should not get any Www-Authenticate header at all.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

0.0% Coverage
0.0% Duplication