742a046fd07bc7227f7db44f29eeefc9f4a3cb2f - gerrit

commit	742a046fd07bc7227f7db44f29eeefc9f4a3cb2f	[log] [tgz]
author	Shawn Pearce <sop@google.com>	Mon Mar 11 12:46:51 2013 -0700
committer	Shawn Pearce <sop@google.com>	Mon Mar 11 12:46:51 2013 -0700
tree	282ec0d7c413203888c713c5620523d14e226c66
parent	353e384e9e77d73ce22712a585396a18becd47ba [diff]

Move RPC auth token from Authorization header to X-Gerrit-Auth

Servers that run with auth.type = HTTP or HTTP_LDAP are unable to
use the web UI because the Authorization code supplied by the UI
overrides the browser's native Authorization header and causes the
request to be blocked at the HTTP reverse proxy, before Gerrit even
sees the request.

Instead insert a unique token into X-Gerrit-Auth, leaving the HTTP
standard Authorization header unspecified and available for use in
HTTP reverse proxies.

Bug: issue 1743
Change-Id: Ice143405dc4d59ade56a6e4a385a4a0995e347ff

gerrit-common/src/main/java/com/google/gerrit/common/data/HostPageData.java[diff]
gerrit-gwtui/src/main/java/com/google/gerrit/client/Gerrit.java[diff]
gerrit-gwtui/src/main/java/com/google/gerrit/client/rpc/RestApi.java[diff]
gerrit-httpd/src/main/java/com/google/gerrit/httpd/CacheBasedWebSession.java[diff]
gerrit-httpd/src/main/java/com/google/gerrit/httpd/WebSession.java[diff]
gerrit-httpd/src/main/java/com/google/gerrit/httpd/WebSessionManager.java[diff]
gerrit-httpd/src/main/java/com/google/gerrit/httpd/raw/HostPageServlet.java[diff]
gerrit-httpd/src/main/java/com/google/gerrit/httpd/rpc/GerritJsonServlet.java[diff]

8 files changed