使用 HTTP 摘要身份验证的 CherryPy 停留在状态 400 错误请求
我使用内置 tools.auth_digest 工具在 CherryPy 应用程序中实现了 HTTP 摘要身份验证。这很简单，而且根据我白天的测试，似乎效果很好。
今天晚上，我尝试从今天早些时候使用的同一浏览器（但从不同的 IP 地址）访问该应用程序。无论出于何种原因，系统都提示我提供凭据。我可能输入了错误的密码，但无论出于何种原因，我再次陷入这样的情况：我的浏览器在每个请求中都发送身份验证标头，但使用 username=""。
Cherrypy 对此做出响应，状态为 400 Bad Request。
我现在面临的情况是，我无法输入新的凭据来进入该网站（使用此浏览器 - 我可以使用未受到错误授权标头“污染”的浏览器，而不会出现任何问题）。要输入新的凭据，我的理解是 CherryPy 应该返回 401 Unauthorized，这应该提示浏览器请求凭据。
我的问题由两部分组成：
如何清除浏览器上的授权信息？
对于这种情况的正确响应应该是 401 Unauthorized 而不是 400 Bad Request，我是否正确？
I implemented HTTP digest authentication in my CherryPy application using the built-in tools.auth_digest tool. This was easy and seemed to work well as I tested during the day.
This evening, I attempted to access the application from the same browser I used earlier today (but from a different IP address). For whatever reason I was prompted for credentials. I may have entered the wrong password but, again for whatever reason, I got into the situation where my browser is sending an authentication header with each request, but with username="".
Cherrypy responds to this with a status of 400 Bad Request.
I'm now in a situation where I can't enter new credentials to get into the site (with this browser — I can use a browser that's not "polluted" with the bad authorization header without trouble). To enter new credentials, my understanding is that CherryPy should return 401 Unauthorized, which should prompt the browser to request credentials.
My two part question is:
What can I do to clear the authorization info on my browser?
Am I correct that the correct response to this situation should be 401 Unauthorized rather than 400 Bad Request?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
正如 Perception 在评论中指出的那样，浏览器在关闭时会忘记凭据。我猜当我测试这个并认为我看到浏览器记住浏览器会话之间的凭据时，我一定是同时在几个不同的窗口中打开了 Chrome。
As pointed out by Perception in the comments, the browser will forget the credentials when closed. I'm guessing that when I tested this and thought I saw the browser remembering credentials between browser sessions that I must have had Chrome open in several different windows simultaneously.