Project

General

Profile

[Solved] IE, PUT, empty request body after authentication, 401 408

Added by dahlke almost 7 years ago

Linux, BusyBox v1.25.1
Lighttpd version: Lighttpd/1.4.37
Configuration: http://paste.lighttpd.net/i2#PjPjDHerwmduzyaAEHrNaVKJ
Client used: IE 11, Edge, Chrome

Let me start this by begging for mercy. Up until about a week ago, I had never touched Lighttpd. Please be gentle :)

I'm stuck trying to find a solution to a rather annoying bug.
Long story short: I need to upload a file that is used to flash the firmware on a small box running Lighttpd 1.4.37. That's done using jQuery and a PUT. Everything works flawlessly in Chrome BUT when using IE it seems like IE posts an empty request body after authentication (see screenshots down below).

If we disable authentication in Lighttpd either completely or just on the PUT that contains the data from the file everything works -even in IE.
With authentication enabled IE prompts for authentication (see screenshot 1) and upon getting that proceeds to send a request where the entire request body is omitted (see screenshot 2). The exact same thing happens no matter if I use IE 11 or Edge.

Just for completeness, I'll include some snippet of the HTML, jQuery and CGI.

Is there anything that can be done as far as configuring Lighttpd that might help solve this issue? Any suggestions would be greatly appreciated :)

*HTML:*
<input id="dupdate-file" type="file" onchange="dupdateFileChanged();"/>

*JavaScript:*
  $.ajax("api/dupdate", {
     method: "PUT",
     contentType: "application/octet-stream",
     processData: false,
     data: dupdateFile,
     success: function(data, status, jqxhr) {
       console.log("OK!");
     },
     error: function(jqxhr, status) {
       console.log("Error, status: " + status);
     }
   });

*CGI*
#!/bin/sh -e
source ./cgi.inc
# parse_put_request

TMPFILE=$(mktemp dupdate.XXXXXX)
dupdate_exit() {
    local exit_status=${1:-$?}
    rm -f $TMPFILE $TMPFILE.out
    cgi_exit $exit_status
}
trap dupdate_exit 0
cat - > $TMPFILE
if dupdate $TMPFILE > $TMPFILE.out ; then
    http_header 200
else
    http_header 500
fi
cat $TMPFILE.out

Screenshots

Screenshot 1 - First request - 401

Screenshot 2 - Second request - 408


Replies (7)

RE: IE, PUT, empty request body after authentication, 401 408 - Added by gstrauss almost 7 years ago

1.4.37 was released a year and a half ago. Do you know if this bad interaction with IE still occurs with lighttpd 1.4.45 (latest version)?

The 408 Request Timeout suggests that IE was waiting for something before sending the request body. The request from IE does include Content-Length, so there does appear to be a request body. Why do you think IE might not be sending the request body?

RE: IE, PUT, empty request body after authentication, 401 408 - Added by gstrauss almost 7 years ago

FYI, I took a look at the older lighttpd 1.4.37 code. Up until lighttpd 1.4.40, lighttpd reads the request body prior to processing the request, including whether or not to run mod_auth. Since this works with Chrome with and without Digest auth, your issue is more likely with the IE client and IE handing of Digest auth. (For kicks, did you test with Basic auth?) On what operating system are you running IE? Have you tried a different machine or different version of operating system?

Check the lighttpd error.log for any messages. If you are running busybox, perhaps you are on an embedded system. Have you run out of disk space where temporary files are created? The PUT in your example is trying to send ~22MB.

For further troubleshooting with lighttpd 1.4.37, you might temporary set server.log-request-header = "enable" and then check lighttpd error.log to see review and verify the request headers received by lighttpd.

I still recommend testing with lighttpd 1.4.45. If you can reproduce the issue with lighttpd 1.4.45, I will spend some time trying to reproduce the issue. (The upcoming lighttpd 1.4.46 adds support for Expect: 100-continue headers, but it does not look like IE is sending that with the request headers.)

RE: IE, PUT, empty request body after authentication, 401 408 - Added by dahlke almost 7 years ago

Thank you so much for your replies, gstrauss. They are much apricated! :)

We'll try upgrading to the latest version of lighttpd. I'll post the result here.

Thanks for letting me know about log-request-header. I'm sure that will come in very handy if we can reproduce the issue in 1.4.45 :)

To answer your questions (just in case the information is needed later on)...

On what operating system are you running IE? Have you tried a different machine or different version of operating system?
I've reproduced the issue using both IE 11 and Edge on my local windows PC running Windows 10 and on a VM running Windows 7 with IE 11

Why do you think IE might not be sending the request body?
Looking at the two requests in Fiddler it looks like the data from the file I'm trying to upload is absent from the second request. It's there in the first request but not in the second.

Have you run out of disk space where temporary files are created?
You are 100% correct in assuming it's an embedded system. There is plenty of disk space available though :)

RE: IE, PUT, empty request body after authentication, 401 408 - Added by dahlke almost 7 years ago

We've updated to lighttpd/1.4.45. I get the exact same result as on the older version. For completeness here is a link to the config we're using. http://paste.lighttpd.net/j2#Q3VibekEi42yfbqBBgHnzqPp.

Yesterday I tried (to upload a file via IE) using a POST instead of a PUT. Same result (401 -> 408). That test was a little rushed so I'd like to test that again just to make sure that was in fact what I was seeing. Color me confused :)

I've tested with a tiny file like you suggested. Same result (401 -> 408).

If you've got any kind of suggestions I'd love to hear them! :)

RE: IE, PUT, empty request body after authentication, 401 408 - Added by gstrauss almost 7 years ago

Suggestion: look into different ways to upload the file from javascript, e.g. http://stackoverflow.com/Questions/5587973/javascript-upload-file or https://www.webcodegeeks.com/html5/html5-file-upload-example/ and find something that works with IE/Edge. Also, make sure you've updated Windows to latest patch levels.

As a workaround, you might try making an ajax request with GET which requires login, and once user has provided credentials for a successful GET request, then attempt the file upload.

    (1-7/7)