Enable a way to provide custom method for "WWW-Authenticate" header

[jackunion]

Enable a way to provide custom method for "WWW-Authenticate" header

[miguelgrinberg]

Sorry, I dropped the ball on this. I have now release 2.7.0, which adds scheme and realm arguments to the two auth constructors. Set the scheme to anything other than Basic/Digest to prevent the browser from displaying the login prompt.

[miguelgrinberg]

Can you be more explicit about this idea? Are you thinking in using a custom header or something else?

[jackunion]

@miguelgrinberg Talking about this popup:

This stackoverflow question and this blog post provide more details.

I think it's really dirty and ugly hack, but I couldn't find anything better.

[miguelgrinberg]

Okay, this is something that is fairly easy to do, I'll look into it. My way of avoiding the login prompt was to return 403 instead of 401. I think this is still a hack, but less than switching status codes.

[soda29]

I would love to have this.

Where does you define to return a 403 instead of a 401?

[miguelgrinberg]

@soda29 In the custom error handler. There you can return one, two or three values, just like you do in a regular Flask view function.

[soda29]

Yes sorry, i managed to change it from the custom error handler with a make_response as the documentation says.

Thanks Miguel!

[jfpoilpret]

Currently, in order to avoid browser popup, I return 401 without WWW-Authenticate header, and that does the trick.
Unfortunately, I have to somehow hack HTTPBasicAuth as follows:

auth = HTTPBasicAuth()

def auth_error_handler():
    res = make_response('Invalid credientials')
    res.status_code = 401
    return res

auth.auth_error_callback = auth_error_handler

But this short-circuits HTTPAuth @error_handler decorator which I cannot use anymore.
I think it would be much better if HTTPAuth supported a kind of no_authenticate_header flag or method to avoid this hack.

[jfpoilpret]

Great Miguel, thanks! I was using release 2.6.0.
Now everything is working fine, just using some "Dummy" authentication scheme.