{"action":"created","issue":{"url":"https://api.github.com/repos/opf/openproject/issues/3026","labels_url":"https://api.github.com/repos/opf/openproject/issues/3026/labels{/name}","comments_url":"https://api.github.com/repos/opf/openproject/issues/3026/comments","events_url":"https://api.github.com/repos/opf/openproject/issues/3026/events","html_url":"https://github.com/opf/openproject/pull/3026","id":81434254,"number":3026,"title":"suppress browser prompt on authenticate failure","user":{"login":"machisuji","id":158871,"avatar_url":"https://avatars.githubusercontent.com/u/158871?v=3","gravatar_id":"","url":"https://api.github.com/users/machisuji","html_url":"https://github.com/machisuji","followers_url":"https://api.github.com/users/machisuji/followers","following_url":"https://api.github.com/users/machisuji/following{/other_user}","gists_url":"https://api.github.com/users/machisuji/gists{/gist_id}","starred_url":"https://api.github.com/users/machisuji/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/machisuji/subscriptions","organizations_url":"https://api.github.com/users/machisuji/orgs","repos_url":"https://api.github.com/users/machisuji/repos","events_url":"https://api.github.com/users/machisuji/events{/privacy}","received_events_url":"https://api.github.com/users/machisuji/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-27T12:57:14Z","updated_at":"2015-05-27T19:52:33Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/opf/openproject/pulls/3026","html_url":"https://github.com/opf/openproject/pull/3026","diff_url":"https://github.com/opf/openproject/pull/3026.diff","patch_url":"https://github.com/opf/openproject/pull/3026.patch"},"body":"If anyone knows a better way to do this let me know. The motivation is that a user should not get to see a password prompt in the browser when their session expired while doing stuff in the work packages list."},"comment":{"url":"https://api.github.com/repos/opf/openproject/issues/comments/106052569","html_url":"https://github.com/opf/openproject/pull/3026#issuecomment-106052569","issue_url":"https://api.github.com/repos/opf/openproject/issues/3026","id":106052569,"user":{"login":"oliverguenther","id":459462,"avatar_url":"https://avatars.githubusercontent.com/u/459462?v=3","gravatar_id":"","url":"https://api.github.com/users/oliverguenther","html_url":"https://github.com/oliverguenther","followers_url":"https://api.github.com/users/oliverguenther/followers","following_url":"https://api.github.com/users/oliverguenther/following{/other_user}","gists_url":"https://api.github.com/users/oliverguenther/gists{/gist_id}","starred_url":"https://api.github.com/users/oliverguenther/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oliverguenther/subscriptions","organizations_url":"https://api.github.com/users/oliverguenther/orgs","repos_url":"https://api.github.com/users/oliverguenther/repos","events_url":"https://api.github.com/users/oliverguenther/events{/privacy}","received_events_url":"https://api.github.com/users/oliverguenther/received_events","type":"User","site_admin":false},"created_at":"2015-05-27T19:52:32Z","updated_at":"2015-05-27T19:52:32Z","body":"Okay, bear with me: Trying to parse your comments and recap into a suggestion.\r\n\r\nOP could communicate through the `WWW-Authenticate` header which authentication methods are available. Browsers officially support Basic (and other options such as Digest, etc., none of which are of interest currently), but according to RFC 2617:\r\n\r\n`401 Unauthorized`\r\n> ... MUST include a WWW-Authenticate header field containing **at least one challenge** \r\n>applicable to the requested resource\r\n\r\nThus I would assume that it would be a suitable method of communicating further options, possibly added by plugins, such as OAuth, etc.\r\n\r\nA `X-Authentication-Scheme = Session` header is currently [appended in the Frontend for all ajax calls](https://github.com/opf/openproject/blob/dev/app/assets/javascripts/application.js.erb#L539-L551).\r\n\r\nThis header could be used to force an authentication scheme used for an API call. From this value, the optimal authentication flow can be determined.\r\n\r\n### Implementation\r\n\r\nWith Warden, it shouldn't be too difficult to express the different schemes. If I recall correctly, currently all strategies are tried in order they are defined in the initializer. With more schemes added to OpenProject, this behavior needs to change anyway.\r\n\r\n\r\n### Examples\r\n\r\n`X-Authentication-Scheme` value | Authentication successful if ... | Authentication\r\n------------ | ------------- | -------------\r\n(empty) | cf. Basic | cf. Basic\r\nBasic | Credentials of `WWW-Authenticate` valid according to PR 2978 | Respond `401 Unauthorized` with `WWW-Authenticate: Basic ..`\r\nSession | Session exists and is valid | Respond `403 Forbidden` unless Session exists\r\nOAuth | Validated url token or `Authorization: Bearer ...` (depending on the actual implementation) | Redirect to OAuth service endpoint / return service url for desktop flow\r\n"}}