2

Setup: Apache 2.2, mod_auth_sspi 1.0.3/1.0.4, mod_wsgi 3.3, python 2.6.2

Some background information: Whenever IE hits an URL, that requires it to perform NTLM challenge-response, further POST requests to the same domain are performed as follows:

  • A zero-length POST (Content-Length 0) is performed
  • The server replies with 401. WWW-Authenticate header contains the NTLMSSP challenge
  • A 'real' (full-length) POST is sent with the Authorization header set to the NTLMSSP_AUTH (response)

And everything is ok.

However, once the page, that doesn't require authentication (the server doesn't respond with 401) is hit, terrible things happen - the zero-length POST is promptly forwarded to the application and all sorts of weirdness ensues, - forms don't get submitted properly, files are not uploaded and so on. I've observed this behaviour with IE 7 and 8.

This is not speculation, - I've actually sniffed the traffic and everything goes exactly as I've outlined above.

Has anyone ever encountered this? I am wondering, what would be the cleanest workaround in this case. Or maybe, this is a non-problem and I am just seeing things?

shylent
  • 10,076
  • 6
  • 38
  • 55

1 Answers1

1

Have a look at the Microsoft KnowledgeBase Article 251404 (http://support.microsoft.com/kb/251404/en-us).

It basically explains what happens and how to work around the issue.

schlenk
  • 7,002
  • 1
  • 25
  • 29