Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!feeds.phibee-telecom.net!newsfeed.xs4all.nl!newsfeed4a.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
MIME-Version: 1.0
In-Reply-To: <6349a85a-f13e-47b1-a5c1-6c87cd96fa2e@googlegroups.com>
References: <6349a85a-f13e-47b1-a5c1-6c87cd96fa2e@googlegroups.com>
Date: Sat, 21 Feb 2015 04:30:21 +1100
Subject: Re: Python Requests logging 401 immediately before 200
From: Chris Angelico <rosuav@gmail.com>
Cc: "python-list@python.org" <python-list@python.org>
Content-Type: text/plain; charset=UTF-8
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.18926.1424453424.18130.python-list@python.org>
Lines: 37
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:85981

On Sat, Feb 21, 2015 at 4:16 AM, Zach Dunlap <zrdunlap@gmail.com> wrote:
> INFO:requests.packages.urllib3.connectionpool:Starting new HTTP connection (1): localhost
> DEBUG:requests.packages.urllib3.connectionpool:"GET /v1/documents?uri=000248e4331d4db5856df8fd427b3cdb.xml HTTP/1.1" 401 211
> DEBUG:requests.packages.urllib3.connectionpool:"GET /v1/documents?uri=000248e4331d4db5856df8fd427b3cdb.xml HTTP/1.1" 200 18327
>
> As you can see the 400 and the 200 are the same document (only 1 can exist in ML with the same URI) and in MarkLogic's logs both are executed at the same time.
>
> Is this something I should be concerned about and should fix or is it just the log level I have set or something else I shouldn't worry about?
>
> r = requests.get('http://localhost:8004/v1/documents?uri=000248e4331d4db5856df8fd427b3cdb.xml',auth=HTTPDigestAuth('USER', 'PASSWORD'))
>

Short explanation: It's part of the protocol.

You're using Digest Auth, so what's happening here is that a request
is sent without the authentication, and the inevitable 401 response is
the signal that the request should be re-sent with credentials.

There's a massive debate as to whether or not it's correct to send
unsolicited credentials. On the one hand, this "401 then 200" pattern
takes extra internet round-trips (not that that's a big deal with
localhost, but it's the same issue everywhere) and puts extra load on
both server and client; but on the other hand, nobody wants their
credentials sent to the wrong server, and it's not always easy to tell
when they'll be needed. Without the 401, you can't know whether or not
you need to authenticate, so if once you start sending unsolicited
credentials, you basically have to keep on doing so.

If you don't have a problem with performance or latency, then consider
this to be nothing more than a bit of log file spam. I'm not sure if
the Python requests module can be easily configured to send
credentials on the first query, but my advice is: don't even bother
looking into that unless you have need to.

All the best!

ChrisA