# OpenUri doesn't retry HTTP credentials after a redirect

**URL:** <https://www.ruby-forum.com/t/openuri-doesnt-retry-http-credentials-after-a-redirect/125816>\
**Category:** Ruby\
**Created:** [January 12, 2008, 12:53pm UTC](https://www.ruby-forum.com/t/openuri-doesnt-retry-http-credentials-after-a-redirect/125816 "2008-01-12T12:53:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![romuloceccon](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/dfb087/32.png) [@romuloceccon](https://www.ruby-forum.com/u/romuloceccon)\
**Post date:** [January 12, 2008, 12:53pm UTC](https://www.ruby-forum.com/t/openuri-doesnt-retry-http-credentials-after-a-redirect/125816/1 "2008-01-12T12:53:40Z")

</div>

Hi.

Ruby’s openuri library has code to specifically drop authentication  
options after being redirected by the server:

/trunk/lib/open-uri.rb@14609, line 212:

```
if options.include? :http_basic_authentication
  # send authentication only for the URI directly specified.
  options = options.dup
  options.delete :http_basic_authentication
end

```

I understand the security issues the code above addresses, but should it  
be so stringent?

An authenticated SVN server which is running over HTTP, for example,  
will redirect pages like [http://www.example.org/svn/project1](http://www.example.org/svn/project1) to  
[http://www.example.org/svn/project1/](http://www.example.org/svn/project1/), with a trailing slash for  
directories. If one tries to open the former URI with open-uri, passing  
a correct :http\_basic\_authentication, it raises a 401 exception – i.e.  
it looks like the wrong credentials were supplied. Opening the later URI  
works, though.

Is there any possibility of a security breach in the case above? IMO,  
the supplied credentials should be tried as long as the domain doesn’t  
change between redirects. If not so, at least open-uri could accept an  
additional parameter controlling its behavior.

What do you think? Should I report a bug?

Thanks in advance.  
Romulo A. Ceccon