$http_rs shows 401 even when final response is 201 (http_async_query + Basic Auth)
Hi all, I'm seeing some unexpected behavior from $http_rs when using http_async_query() to send a POST request to an endpoint that requires Basic (username/password) authentication. When I use: ``` $http_req(username) = "someuser"; $http_req(password) = "somepass"; ``` the request goes through and the server responds with a *201 Created*, as expected. The response body ($http_rb) contains the correct result. However, $http_rs still shows *401 Unauthorized*. I believe this happens because curl receives a 401 challenge first, then retries with the provided credentials and gets the correct 201. It seems $http_rs is reflecting the status from the initial challenge rather than the final response. This is on Kamailio v6.0.1. As a workaround, I tried manually setting the *Authorization* header like this: ``` $var(credentials) = "someuser:somepass"; $http_req(hdr) = "Authorization: Basic " + $(var(credentials){s.encode.base64}); ``` In that case, $http_rs correctly shows 201. Is it expected for $http_rs to stay at 401 in the first scenario? Or should it reflect the final status code after curl completes the full request cycle? Thanks, Joel.
Hi, thank you for reporting. This is not what I would expect, honestly I don't remember having faced this issue when I implemented this. I went quickly through the code and I don't understand the reason for returning 401, since $http_rs is a wrapper around core function get_status which get the result code of a SIP reply (HTTP's ones are treated the same way). I will look deeper in the next few days. Regards, Federico On Mon, Jun 16, 2025 at 8:52 AM Joel Serrano via sr-users < sr-users@lists.kamailio.org> wrote:
Hi all,
I'm seeing some unexpected behavior from $http_rs when using http_async_query() to send a POST request to an endpoint that requires Basic (username/password) authentication.
When I use:
``` $http_req(username) = "someuser"; $http_req(password) = "somepass"; ```
the request goes through and the server responds with a *201 Created*, as expected. The response body ($http_rb) contains the correct result. However, $http_rs still shows *401 Unauthorized*.
I believe this happens because curl receives a 401 challenge first, then retries with the provided credentials and gets the correct 201. It seems $http_rs is reflecting the status from the initial challenge rather than the final response. This is on Kamailio v6.0.1.
As a workaround, I tried manually setting the *Authorization* header like this:
``` $var(credentials) = "someuser:somepass"; $http_req(hdr) = "Authorization: Basic " + $(var(credentials){s.encode.base64}); ```
In that case, $http_rs correctly shows 201.
Is it expected for $http_rs to stay at 401 in the first scenario? Or should it reflect the final status code after curl completes the full request cycle?
Thanks, Joel. __________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions -- sr-users@lists.kamailio.org To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender!
Hi, sorry for the delay, I've just pushed a commit on master ( https://github.com/kamailio/kamailio/commit/e8441d8f6a8a33c5aa4e4fbbe71a01d0... ). If you could test and confirm that it works (I tested it locally) I will also backport it to stable branches. Thank you. Best regards, Federico On Tue, Jun 17, 2025 at 8:32 AM Federico Cabiddu <federico.cabiddu@gmail.com> wrote:
Hi, thank you for reporting. This is not what I would expect, honestly I don't remember having faced this issue when I implemented this. I went quickly through the code and I don't understand the reason for returning 401, since $http_rs is a wrapper around core function get_status which get the result code of a SIP reply (HTTP's ones are treated the same way). I will look deeper in the next few days.
Regards,
Federico
On Mon, Jun 16, 2025 at 8:52 AM Joel Serrano via sr-users < sr-users@lists.kamailio.org> wrote:
Hi all,
I'm seeing some unexpected behavior from $http_rs when using http_async_query() to send a POST request to an endpoint that requires Basic (username/password) authentication.
When I use:
``` $http_req(username) = "someuser"; $http_req(password) = "somepass"; ```
the request goes through and the server responds with a *201 Created*, as expected. The response body ($http_rb) contains the correct result. However, $http_rs still shows *401 Unauthorized*.
I believe this happens because curl receives a 401 challenge first, then retries with the provided credentials and gets the correct 201. It seems $http_rs is reflecting the status from the initial challenge rather than the final response. This is on Kamailio v6.0.1.
As a workaround, I tried manually setting the *Authorization* header like this:
``` $var(credentials) = "someuser:somepass"; $http_req(hdr) = "Authorization: Basic " + $(var(credentials){s.encode.base64}); ```
In that case, $http_rs correctly shows 201.
Is it expected for $http_rs to stay at 401 in the first scenario? Or should it reflect the final status code after curl completes the full request cycle?
Thanks, Joel. __________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions -- sr-users@lists.kamailio.org To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender!
Hey Federico, Sure thing, I'll test and let you know. Thanks, Joel. On Tue, Aug 5, 2025 at 12:45 AM Federico Cabiddu <federico.cabiddu@gmail.com> wrote:
Hi, sorry for the delay, I've just pushed a commit on master ( https://github.com/kamailio/kamailio/commit/e8441d8f6a8a33c5aa4e4fbbe71a01d0... ). If you could test and confirm that it works (I tested it locally) I will also backport it to stable branches. Thank you.
Best regards,
Federico
On Tue, Jun 17, 2025 at 8:32 AM Federico Cabiddu < federico.cabiddu@gmail.com> wrote:
Hi, thank you for reporting. This is not what I would expect, honestly I don't remember having faced this issue when I implemented this. I went quickly through the code and I don't understand the reason for returning 401, since $http_rs is a wrapper around core function get_status which get the result code of a SIP reply (HTTP's ones are treated the same way). I will look deeper in the next few days.
Regards,
Federico
On Mon, Jun 16, 2025 at 8:52 AM Joel Serrano via sr-users < sr-users@lists.kamailio.org> wrote:
Hi all,
I'm seeing some unexpected behavior from $http_rs when using http_async_query() to send a POST request to an endpoint that requires Basic (username/password) authentication.
When I use:
``` $http_req(username) = "someuser"; $http_req(password) = "somepass"; ```
the request goes through and the server responds with a *201 Created*, as expected. The response body ($http_rb) contains the correct result. However, $http_rs still shows *401 Unauthorized*.
I believe this happens because curl receives a 401 challenge first, then retries with the provided credentials and gets the correct 201. It seems $http_rs is reflecting the status from the initial challenge rather than the final response. This is on Kamailio v6.0.1.
As a workaround, I tried manually setting the *Authorization* header like this:
``` $var(credentials) = "someuser:somepass"; $http_req(hdr) = "Authorization: Basic " + $(var(credentials){s.encode.base64}); ```
In that case, $http_rs correctly shows 201.
Is it expected for $http_rs to stay at 401 in the first scenario? Or should it reflect the final status code after curl completes the full request cycle?
Thanks, Joel. __________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions -- sr-users@lists.kamailio.org To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender!
participants (2)
-
Federico Cabiddu -
Joel Serrano