{"action":"created","issue":{"url":"https://api.github.com/repos/munki/munki/issues/622","repository_url":"https://api.github.com/repos/munki/munki","labels_url":"https://api.github.com/repos/munki/munki/issues/622/labels{/name}","comments_url":"https://api.github.com/repos/munki/munki/issues/622/comments","events_url":"https://api.github.com/repos/munki/munki/issues/622/events","html_url":"https://github.com/munki/munki/issues/622","id":161995276,"number":622,"title":"Munki does not send HTTP Basic Authorization when redirected","user":{"login":"MichalMMac","id":3882687,"avatar_url":"https://avatars.githubusercontent.com/u/3882687?v=3","gravatar_id":"","url":"https://api.github.com/users/MichalMMac","html_url":"https://github.com/MichalMMac","followers_url":"https://api.github.com/users/MichalMMac/followers","following_url":"https://api.github.com/users/MichalMMac/following{/other_user}","gists_url":"https://api.github.com/users/MichalMMac/gists{/gist_id}","starred_url":"https://api.github.com/users/MichalMMac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MichalMMac/subscriptions","organizations_url":"https://api.github.com/users/MichalMMac/orgs","repos_url":"https://api.github.com/users/MichalMMac/repos","events_url":"https://api.github.com/users/MichalMMac/events{/privacy}","received_events_url":"https://api.github.com/users/MichalMMac/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2016-06-23T18:47:02Z","updated_at":"2016-08-12T21:22:25Z","closed_at":null,"body":"I am currently trying to setup HTTP redirecting for Munki. \r\n\r\n- Munki (A) - server accessible over the internet - HTTPS + HTTP Basic auth\r\n- Munki (B) - server on LAN (cache for pkgs directory) HTTPS\r\n- Client at LAN \r\n    - Munki 2.7.1\r\n    - HTTP Basic auth is set in `/private/var/root/Library/Preferences/ManagedInstalls.plist`\r\n    - FollowHTTPRedirects is set in to `all` (tested also with `https`) in `/Library/Preferences/ManagedInstalls.plist`\r\n\r\nIn this configuration redirecting from A to B works fine when clients are present at LAN (behind NAT with static public IPv4).\r\n\r\n## Problem\r\n\r\nI turned on **HTTP Basic** auth on Munki (B)\r\n\r\nWhen Munki client is redirected from Munki (A) to Munki (B) client does not send `Authorization` HTTP header to Munki (B). When I look  at HTTP headers via Wireshark there is no `Authorization` header."},"comment":{"url":"https://api.github.com/repos/munki/munki/issues/comments/239563053","html_url":"https://github.com/munki/munki/issues/622#issuecomment-239563053","issue_url":"https://api.github.com/repos/munki/munki/issues/622","id":239563053,"user":{"login":"aysiu","id":13055957,"avatar_url":"https://avatars.githubusercontent.com/u/13055957?v=3","gravatar_id":"","url":"https://api.github.com/users/aysiu","html_url":"https://github.com/aysiu","followers_url":"https://api.github.com/users/aysiu/followers","following_url":"https://api.github.com/users/aysiu/following{/other_user}","gists_url":"https://api.github.com/users/aysiu/gists{/gist_id}","starred_url":"https://api.github.com/users/aysiu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aysiu/subscriptions","organizations_url":"https://api.github.com/users/aysiu/orgs","repos_url":"https://api.github.com/users/aysiu/repos","events_url":"https://api.github.com/users/aysiu/events{/privacy}","received_events_url":"https://api.github.com/users/aysiu/received_events","type":"User","site_admin":false},"created_at":"2016-08-12T21:22:25Z","updated_at":"2016-08-12T21:22:25Z","body":"I'm not an http redirect expert by any means, nor are strangers on the Internet, but based on these two popular Stack Overflow responses, I'd say it's expected behavior:\r\nhttp://stackoverflow.com/questions/28564961/authorization-header-is-lost-on-redirect/28671822#28671822\r\nhttp://stackoverflow.com/questions/17092259/should-authorization-be-kept-when-redirection-is-handled/17116714#17116714\r\n\r\nhttp redirects are not supposed to redirect the authorization headers, apparently.\r\n\r\nAt this point, what are we looking for? More testing/confirmation that it's not being forwarded? Or, we already know it's not happening, and what's a PR workaround that will fix it?"}}
{"actor":{"display_login":"aysiu"}}