From b2f2b85ad5f3456c0a14f36602122d393f01f7fe Mon Sep 17 00:00:00 2001 From: "Wladimir J. van der Laan" Date: Fri, 5 Feb 2016 10:45:50 +0100 Subject: rpc: Add WWW-Authenticate header to 401 response A WWW-Authenticate header must be present in the 401 response to make clients know that they can authenticate, and how. WWW-Authenticate: Basic realm="jsonrpc" Fixes #7462. Github-Pull: #7472 Rebased-From: 7c06fbd8f58058d77c3e9da841811201d2e45e92 --- src/httprpc.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/httprpc.cpp b/src/httprpc.cpp index 2920aa26f7..f6fa988b95 100644 --- a/src/httprpc.cpp +++ b/src/httprpc.cpp @@ -17,6 +17,9 @@ #include // boost::trim #include //BOOST_FOREACH +/** WWW-Authenticate to present with 401 Unauthorized response */ +static const char* WWW_AUTH_HEADER_DATA = "Basic realm=\"jsonrpc\""; + /** Simple one-shot callback timer to be used by the RPC mechanism to e.g. * re-lock the wellet. */ @@ -147,6 +150,7 @@ static bool HTTPReq_JSONRPC(HTTPRequest* req, const std::string &) // Check authorization std::pair authHeader = req->GetHeader("authorization"); if (!authHeader.first) { + req->WriteHeader("WWW-Authenticate", WWW_AUTH_HEADER_DATA); req->WriteReply(HTTP_UNAUTHORIZED); return false; } @@ -159,6 +163,7 @@ static bool HTTPReq_JSONRPC(HTTPRequest* req, const std::string &) shouldn't have their RPC port exposed. */ MilliSleep(250); + req->WriteHeader("WWW-Authenticate", WWW_AUTH_HEADER_DATA); req->WriteReply(HTTP_UNAUTHORIZED); return false; } -- cgit v1.2.3