What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

I'm behind a firewall that doesn't trust HTTP content without an HTTP content-type header.

When I attempt to OAuth, only on a handful of some of the sister-sites, I receive a notice on pages such as: http://stackexchange.com/users/authenticate

Reason: header 'Content-Type' denied rule='Default' value='' 
Method: POST 
Host: stackexchange.com 
Path: /users/authenticate 

Can we have the server issue the HTTP header? I can't see a reason why we wouldn't be doing so in the first place.

If it's helpful for your debugging, this is my traceroute path:

 5  ge10-3.gwy1-mtl.bb.allstream.net (199.212.161.198)  25.673 ms  26.663 ms  27.217 ms
 (Empty section " * * * " redacted)
 11  gwny01.stackoverflow.com (64.34.41.58)  32.925 ms  32.708 ms  35.519 ms

And here's the HTTP POST request my user-agent made (sensitive information is redacted)

POST /users/authenticate HTTP/1.1
Host: stackexchange.com
Connection: keep-alive
Content-Length: 96
Cache-Control: max-age=0
Origin: http://stackexchange.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://stackexchange.com/users/login?returnurl=%2f
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=[redacted]; m=4; gauthed=1; __utma=[redacted]; __utmb=[redacted]; __utmc=[redacted]; __utmz=[redacted].4.3.utmcsr=chat.stackexchange.com|utmccn=(referral)|utmcmd=referral|utmcct=/; se-usr=t=[redacted]

oauth_version=&oauth_server=&openid_identifier=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid
share|improve this question
1  
Weird, looking into why se.com isn't sending that header; the code is practically identical to stackoverflow's and it does send it. –  Kevin Montrose Jan 20 '12 at 19:30
    
The failure is intermittent, perhaps there's a node somewhere that changes the header. I'll update in a moment with a tracert. –  Incognito Jan 20 '12 at 19:49
    
To clarify by intermittent, I mean in terms of months. Some months this works, other months this fails. Once auth happens I am not kicked out, but the auth process its self has this behavior. –  Incognito Jan 20 '12 at 20:03
add comment

1 Answer

up vote 5 down vote accepted

We should be sending Content-Type down on /users/authenticate from stackexchange.com now.

Looks like the dotNetOpenAuth reference was rather out of date on that site.

share|improve this answer
    
In record time! =) –  jadarnel27 Jan 20 '12 at 21:28
    
Perfect, I'm authenticated on all domains. Thanks :). –  Incognito Jan 20 '12 at 21:29
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .