Dear Maintainer,
Liferea is repeatedly asking for HTTP Basic Auth credentials on feeds
with stored credentials, although the first update for each feed
succeeds. I think this is due to trying to re-use a nonce.
Here is an example feed; a free Livejournal account's credentials are
sufficient for login. davis-square community membership is not
required:
http://davis-square.livejournal.com/data/rss?auth=digest
When Liferea is first launched, these feeds authenticate
successfully. Wireshark shows that each initial response is a 401, and
that Liferea then correctly re-sends with an Authorization: Digest
header using the nonce and algorithm requested. However, subsequent
updates to the feed simply send the same Authorization: Digest line as
before, with the same nonce. The feed server responds with a 401 and a
different nonce, and Liferea gives up and prompts for username and
password (sometimes blank, sometimes pre-filled -- different bug, or a
consequence of this one?) Entering or accepting the credentials
allows the update to proceed.
The consequence is that if I leave Liferea running, it slowly spams me
with Authentication dialogs, sometimes stealing focus. My current
workaround is to not leave Liferea running, but to periodically launch
it, Update All, then close it when I'm done.
I'm willing to upgrade to 1.10 *if* the data format for Liferea (and
dependencies) is the same as for 1.8 (so that I can downgrade again if
need be.)
Thank you for your work on Liferea!
- Tim McCormack