Re: [users@httpd] Browsers appear to be ignoring 401 responses with WWW-Authenticate

2021-10-04 Thread Daniel Ferradal
Another side note: OAM, redirects and CORS... Another victim of the "samesite" debacle? Oracle released a "fix" so oam and webgate would specify "samesite" cookie parameter and/or to specify whatever you wanted in it... if that's your case. Cheers El lun, 4 oct 2021 a las 5:43, ohaya ()

Re: [users@httpd] Browsers appear to be ignoring 401 responses with WWW-Authenticate

2021-10-04 Thread ohaya
Hi, I just found this thread in SO: https://stackoverflow.com/questions/18499465/cors-and-http-basic-auth and specifically the response from "Brock Allen" on Aug 29, 2013: "If you're requesting credentials then the server must respond with the specific origin in the

Re: [users@httpd] Browsers appear to be ignoring 401 responses with WWW-Authenticate

2021-10-04 Thread Eric Covener
On Sun, Oct 3, 2021, 9:05 PM ohaya wrote: > Hi, > > We are hosting a page on one of our Apache (2.4.29). We use Oracle OAM > webgate in this Apache to "protect" that page. When the webgate is > installed into the Apache, they include a configuration file that has: > > > Does removing the *

Re: [users@httpd] Browsers appear to be ignoring 401 responses with WWW-Authenticate

2021-10-03 Thread ohaya
Hi,  To be honest basic authentication is not a preference, but I'm looking into it because OAM supports what do you call sessionless basic authentication. And that is the only authentication method that OAM supports that doesn't require redirects, and previous work that I've done ready to

Re: [users@httpd] Browsers appear to be ignoring 401 responses with WWW-Authenticate

2021-10-03 Thread Daniel Gruno
Slightly off-topic, but you might wanna check out https://developer.mozilla.org/en-US/docs/Web/API/fetch#parameters Standard modern behavior, AIUI, is to not do Basic Auth via JavaScript fetches unless it's the same site, but this can be modified. But I could be wrong :) On 04/10/2021 03.04,

[users@httpd] Browsers appear to be ignoring 401 responses with WWW-Authenticate

2021-10-03 Thread ohaya
Hi, We are hosting a page on one of our Apache (2.4.29). We use Oracle OAM webgate in this Apache to "protect" that page. When the webgate is installed into the Apache, they include a configuration file that has: AuthType Oblix require valid-user We have this page configured for BASIC