为什么 Firefox 不断协商 kerberos 服务票证？
我对 Kerberos 进行了一些测试，发现了一些与 Firefox 和 Kerberos 相关的奇怪行为。我有一台运行 Apache + mod_auh_kerb 的服务器，该服务器配置为在处理来自客户端的请求时检查 kerberos 凭据。执行 Kerberos 身份验证，并且拒绝没有有效凭据的用户。但是，我不明白以下内容：
发出第一个请求后，TGS 会缓存在客户端的 /tmp/krb5ccXXXX 中，但网络捕获显示 Firefox 为每个连接请求 TGS。由于我的服务票证已被缓存，那么为什么不将其重新用于其他请求？每个连接如下：
client = GET index.html ==>服务器
客户端 <= 401 需要身份验证 = 服务器
客户端 = TGS-REQ => KDC
...
客户端 <= TGS-REP = KDC
客户端 = GET index.html + kerberos 负载 =>服务器
client <= 200 OK = server
这不是配置问题，因为 Konqueror 按预期执行。
有什么想法吗？
提前致谢。
PS：这对于 GET 请求来说并不是一个大问题，但考虑基于表单的上传（POST）数据不应该发送两次到服务器！
I ran some tests on Kerberos and found out some strange behavior related to Firefox and Kerberos. I have a server running Apache + mod_auh_kerb which is configured to check kerberos credential when serving requests from clients. Kerberos authentication is performed and user without valid credentials are rejected. However, I do not understand the following:
Once the first request is made, a TGS is cached on the client in /tmp/krb5ccXXXX, but a network capture revealed that firefox request a TGS for every single connections. As my service ticket is cached then why isn't it re-used for other requests ? Every connections are as follows:
client = GET index.html => server
client <= 401 Auth required = server
client = TGS-REQ => KDC
...
client <= TGS-REP = KDC
client = GET index.html + kerberos payload => server
client <= 200 OK = server
This is not a configuration issue as Konqueror perform as expected.
Any ideas ?
Thanks in advance.
PS: This is not such a big issue for GET requests but consider form-based uploads (POST) data should not be sent twice to the server !!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为没有问题。 /tmp/ 中的文件意味着 kerberos 票证已缓存。 Apache 对每个请求都查询身份验证，并且不应用任何缓存。 Konqueror 足够聪明，可以进行自己的缓存并自动以正确的票证进行响应。
I don't think there is a problem. The files in /tmp/ mean the kerberos ticket is cached. Apache queries for auth with every request and does not apply any caching. Konqueror just is smart enough to do its own caching and responds automatically with the correct ticket.