bug#35688: url-auth prompt is blank when realm is the empty string

bug#35688: url-auth prompt is blank when realm is the empty string

[Thomas Fitzsimmons]

Hi,

When a website returns an empty string for realm, url-get-authentication
prompts:

Username [for ]:

See for example:

(url-retrieve-synchronously "https://outlook.office365.com/EWS/Exchange.asmx")

The attached patch makes the prompt contain the full URL, and applies to
all auth schemes.  However, maybe each auth scheme should decide how to
handle a "" realm and to fix this particular case I should just change
url-basic-auth?  I'm open to suggestions.

Anyway, I'm filing this bug because I think prompting for a username and
password while not showing the user the requested URL is a usability
problem.

Thomas

diff --git a/lisp/url/url-auth.el b/lisp/url/url-auth.el
index 0746cfd96c..f644787cc6 100644
--- a/lisp/url/url-auth.el
+++ b/lisp/url/url-auth.el
@@ -478,6 +478,8 @@ url-get-authentication
        if one cannot be found in the cache"
   (if (not realm)
       (setq realm (cdr-safe (assoc "realm" args))))
+  (if (equal realm "")
+      (setq realm nil))
   (if (stringp url)
       (setq url (url-generic-parse-url url)))
   (if (or (null type) (eq type 'any))

bug#35688: url-auth prompt is blank when realm is the empty string

[Lars Ingebrigtsen]

Thomas Fitzsimmons <fitzsim@fitzsim.org> writes:

> See for example:
>
> (url-retrieve-synchronously "https://outlook.office365.com/EWS/Exchange.asmx")
>
> The attached patch makes the prompt contain the full URL, and applies to
> all auth schemes.  However, maybe each auth scheme should decide how to
> handle a "" realm and to fix this particular case I should just change
> url-basic-auth?  I'm open to suggestions.
>
> Anyway, I'm filing this bug because I think prompting for a username and
> password while not showing the user the requested URL is a usability
> problem.

I think your fix sounds sufficient, so I've applied it to Emacs 27.1 as
is.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no