Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 155 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I'm behind a firewall that doesn't trust HTTP content without an HTTP content-type header.

When I attempt to OAuth, only on a handful of some of the sister-sites, I receive a notice on pages such as: http://stackexchange.com/users/authenticate

Reason: header 'Content-Type' denied rule='Default' value='' 
Method: POST 
Host: stackexchange.com 
Path: /users/authenticate 

Can we have the server issue the HTTP header? I can't see a reason why we wouldn't be doing so in the first place.

If it's helpful for your debugging, this is my traceroute path:

 5  ge10-3.gwy1-mtl.bb.allstream.net (199.212.161.198)  25.673 ms  26.663 ms  27.217 ms
 (Empty section " * * * " redacted)
 11  gwny01.stackoverflow.com (64.34.41.58)  32.925 ms  32.708 ms  35.519 ms

And here's the HTTP POST request my user-agent made (sensitive information is redacted)

POST /users/authenticate HTTP/1.1
Host: stackexchange.com
Connection: keep-alive
Content-Length: 96
Cache-Control: max-age=0
Origin: http://stackexchange.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://stackexchange.com/users/login?returnurl=%2f
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=[redacted]; m=4; gauthed=1; __utma=[redacted]; __utmb=[redacted]; __utmc=[redacted]; __utmz=[redacted].4.3.utmcsr=chat.stackexchange.com|utmccn=(referral)|utmcmd=referral|utmcct=/; se-usr=t=[redacted]

oauth_version=&oauth_server=&openid_identifier=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid
share|improve this question
1  
Weird, looking into why se.com isn't sending that header; the code is practically identical to stackoverflow's and it does send it. – Kevin Montrose Jan 20 '12 at 19:30
    
The failure is intermittent, perhaps there's a node somewhere that changes the header. I'll update in a moment with a tracert. – Incognito Jan 20 '12 at 19:49
    
To clarify by intermittent, I mean in terms of months. Some months this works, other months this fails. Once auth happens I am not kicked out, but the auth process its self has this behavior. – Incognito Jan 20 '12 at 20:03
up vote 5 down vote accepted

We should be sending Content-Type down on /users/authenticate from stackexchange.com now.

Looks like the dotNetOpenAuth reference was rather out of date on that site.

share|improve this answer
    
In record time! =) – jadarnel27 Jan 20 '12 at 21:28
    
Perfect, I'm authenticated on all domains. Thanks :). – Incognito Jan 20 '12 at 21:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .