I'm not sure what browser you're using where each authenticated page request requires two hits, but IE will send authentication information for all subsequent hits in the same area without being asked. The first request obviously is rejected on the grounds that no authentication information is provided, but after that the browser should know to send it automatically.
I think you're mixing up cookies and auth here, or perhaps the caching of auth performed by a browser. A browser is not supposed to sent auth unless challenged. IE remembers that you auth'ed in an area (against a particular realm name), and resends its stored auth in the same area, but it can't know which auth to send until it gets a challenge with the realm name. And it can't get the challenge unless it sends it without auth the first time.

I just verified this in a basicauth protected area of my website. iCab gets it right, waiting for the challenge on each hit. And yes, NS and IE both do it wrong, sending an auth before being challenged. How sucky. How do they know which realm to send up? Or do they just do the most recent realm? That could be a security hole.

Ahh, RFC2617 agrees with both of us {grin}:

A client MAY preemptively send the corresponding Authorization header with requests for resources in that space without receipt of another challenge from the server. Similarly, when a client sends a request to a proxy, it may reuse a userid and password in the Proxy-Authorization header field without receiving another challenge from the proxy server. See section 4 for security considerations associated with Basic authentication.
Hmm. I did not know the preemptive auth send. Thanks for pointing that out to me.

-- Randal L. Schwartz, Perl hacker

In reply to RE: RE: RE: Answer: Security: Cookies vs HTTP authentication by merlyn
in thread Security: Cookies vs HTTP authentication by rodry

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.