<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Am 31.01.2013 12:52, schrieb Daniel Molkentin:<br>
<span style="white-space: pre;">><br>
> On 31.01.2013, at 12:43, hemathor wrote:<br>
><br>
>> hey,<br>
>><br>
>> i have ssl activated.<br>
>> looking at the httpd logfile, there are always two
propfind requests:<br>
>><br>
>> 127.0.0.1 - - [31/Jan/2013:12:39:34 +0100] "PROPFIND
/owncloud/remote.php/webdav/clientsync HTTP/1.1" 401 291<br>
>> 127.0.0.1 - hemathor [31/Jan/2013:12:39:34 +0100]
"PROPFIND /owncloud/remote.php/webdav/clientsync HTTP/1.1" 207 630<br>
>><br>
>> why does the client issue an unencrypted request although
ssl is activated?<br>
><br>
> Where do you see an unencrypted request here? I just see one
unauthenticated and one authenticated here. The log tells nothing
about the encryption status.<br>
><br>
> SSL is transport layer security, i.e. in encrypts the data
stream, regardless on higher level protocols' authentication
scheme. It doesn't know nor care. HTTP auth is then applied on top
(i.e. inside the encrypted data stream), and the way it works is
to issue a request, and wait for the server to ask for
authentication (which it does, 401). The client will then follow
up with an attempt to present its credentials, which succeeds
(207, webdav multi status).<br>
><br>
> Cheers,<br>
> Daniel<br>
><br>
> --<br>
> <a class="moz-txt-link-abbreviated" href="http://www.owncloud.com">www.owncloud.com</a> <a class="moz-txt-link-rfc2396E" href="http://www.owncloud.com"><http://www.owncloud.com></a> - Your Data,
Your Cloud, Your Way!<br>
><br>
> ownCloud GmbH, GF: Markus Rex, Holger Dyroff<br>
> Schloßäckerstrasse 26a, 90443 Nürnberg, HRB 28050 (AG
Nürnberg)<br>
><br>
><br>
><br>
> _______________________________________________<br>
> Owncloud mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Owncloud@kde.org">Owncloud@kde.org</a><br>
> <a class="moz-txt-link-freetext" href="https://mail.kde.org/mailman/listinfo/owncloud">https://mail.kde.org/mailman/listinfo/owncloud</a></span><br>
<br>
Okay, not talking about the ssl/nonssl. BUT... Why are there two
requests? I know how normally http auth is used with the server
asking for auth with 401. But this doubles the needed requests.<br>
<br>
Why not sending the auth on every request after the server asks the
first time for the credentials. I don't know how this could trigger
security problems as long as the ssl cert getting validated. Because
it is just a <a class="moz-txt-link-freetext" href="https://user:pass@owncloud.server.foo">https://user:pass@owncloud.server.foo</a> and would save
lots of requests.<br>
<br>
This "useless" 401 requests are causing really heavy overhead when
syncing folders with many (small) subfolders/files.<br>
<br>
I know this is bad style http, but we know where auth is needed. So
i think it is worth the bad style, if we could save these expected
401 requests.<br>
<br>
<br>
TimmeeY<br>
<br>
</body>
</html>