Re: can persistent auth be disabled?

> This begs the question: how is curl supposed to figure this out rather
than to presume?

This seems to be the spec that covers that:
https://tools.ietf.org/id/draft-montenegro-httpbis-multilegged-auth-01.html#rfc.section.3

Summarizing, it looks like the correct behavior should be: queue requests
until you know whether you're doing persistent auth (aka connection based)
or non-persistent auth (aka request based). Switch to persistent auth only
if you get a response header that explicitly turns it on.

Seems like this part of curl needs some significant work. I'm thinking
about trying to do that myself. Would a contribution that attempts to make
curl's behavior line up with this specification be likely to be accepted?
Any thoughts or advice on how best to approach a contribution in this area
of the code? For example, is there a particular person who would want to
approve/disapprove a proposed design?

Whitney

-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette: https://curl.haxx.se/mail/etiquette.html
Received on 2020-02-28