Tim Abbott 250781e843 Fix HTTP Basic Auth popups caused by auth failures. ...

If a user's session cookie expired, the next REST API request their
browser did would go into the json_unauthorized code path.  This
returned a response with a WWW-Authenticate tag for HTTP Basic Auth
(since that's what the REST API uses), even for /json requests which
should only be authenticated using session auth.

We fix this by explicitly passing the desired WWW-Authenticate state.

Fixes: #800.

2016-06-21 16:18:36 -07:00

4.4 KiB

Raw Blame History

View Raw