[Cyberduck-trac] [Cyberduck] #7139: Problems with WebDAV authorization handling

[Cyberduck]

#7139: Problems with WebDAV authorization handling
----------------------------+---------------------------
    Reporter:  billhuber01  |      Owner:  dkocher
        Type:  defect       |     Status:  new
    Priority:  normal       |  Milestone:
   Component:  webdav       |    Version:  4.2.1
    Severity:  normal       |   Keywords:  authorization
Architecture:               |   Platform:  Windows 7
----------------------------+---------------------------
 There's some dysfunctional behavior in Cyberduck when paired with the
 WebDAV server provided with the Apache web server. Basically, the
 authorization handling in Cyberduck allows you to shoot yourself in the
 foot in various ways that are not intuitive.

 Given the authorization scheme which we've implemented with our Apache web
 server, users can see all top-level folders even if they lack proper
 authorization to some of those folders. The problem is that if you can see
 a folder that you're not authorized to access, you might try to access it
 from Cyberduck either out of curiosity, due to a mistake, or some other
 reason. That's where the problem begins.

 If a user accesses a folder that they aren't authorized to access,
 Cyberduck will present the user with a login screen even though you've
 already supplied credentials by opening the connection to the WebDAV
 server. If you supply the correct credentials for the login, the user gets
 a "Login failed" message and another opportunity to try and login again.
 When you eventually get tired of entering the correct credentials and
 still getting the login prompt, you can cancel out of the login prompt.
 But, at that point, you no longer have access to anything!! Every folder
 you try to access anew will give you an error in Cyberduck (the little red
 circle with the line in it). In short, you have no legitimate options once
 you've accessed a folder that you aren't authorized for.

 In summary, Cyberduck displays folders (most notably, top-level folders)
 for which you have no authorization and if you try to access them, your
 Cyberduck session will largely be ruined. Your only choice at that point
 is to reconnect and try again to do what you intended. But even if you
 reconnect, you must be careful to access only folders for which you are
 authorized or the same problem will happen again. That's the dysfunction.

 Cyberduck should clearly not show a login prompt as a response to a failed
 authorization. The login is about authentication and that has already
 occurred. Authorization is about a different point. I would have thought
 that the best (and most common approach) is to display only those file
 objects for which a user has proper authorization. But whatever the
 response is, the current operation in Cyberduck is inappropriate and
 certainly frustrating for users.

-- 
Ticket URL: <http://trac.cyberduck.ch/ticket/7139>
Cyberduck <http://cyberduck.ch>
Open source FTP, SFTP, WebDAV, Cloud Files, Google Docs & Amazon S3 Browser for Mac & Windows.