840494 - Proxy Auth: some content is loaded from second try

Status: RESOLVED INCOMPLETE

(Core :: Networking: HTTP, defect)

Description

[peter]

Attachment: denied.utf8.LF.log.2

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:18.0) Gecko/20100101 Firefox/18.0
Build ID: 20130201065344

Steps to reproduce:

I using Squid proxy + kerberos auth.
I tried to read a ( http://www.prosovet4ik.ru/news/health/how-to-choose-a-doctor/ ) page. And it push me to a little research. 
It is not unique page, sometime other page is broken if CSS is not loaded correctly.


Actual results:

When I opening the page at first time, Firefox opens it without stylesheet(CSS). Look in Squid log:
<<<<<<<<<<<<<<<<
1360667056.454     70 172.16.0.110 TCP_DENIED/407 1909 GET http://www.prosovet4ik.ru/bitrix/templates/.default/components/skyboom_components/news.detail/.default/style.css? - NONE/- text/html
1360667056.454     69 172.16.0.110 TCP_DENIED/407 1888 GET http://www.prosovet4ik.ru/bitrix/templates/prosovet_profy_copy/components/bitrix/menu/template2/style.css? - NONE/- text/html
1360667056.454     67 172.16.0.110 TCP_DENIED/407 1792 GET http://www.prosovet4ik.ru/bitrix/templates/prosovet_profy_copy/styles.css? - NONE/- text/html
1360667056.454     66 172.16.0.110 TCP_DENIED/407 1819 GET http://www.prosovet4ik.ru/bitrix/templates/prosovet_profy_copy/template_styles.css? - NONE/- text/html
...
1360667056.661    288 172.16.0.110 TCP_MISS/200 1219 GET http://www.prosovet4ik.ru/bitrix/templates/prosovet_profy_copy/components/bitrix/menu/horizontal_multilevel1/style.css? me@MYDOM DIRECT/212.59.117.39 text/css

...
...
1360667949.738    104 172.16.0.110 TCP_REFRESH_UNMODIFIED/304 306 GET http://www.prosovet4ik.ru/bitrix/templates/prosovet_profy_copy/components/bitrix/menu/horizontal_multilevel1/style.css? me@MYDOM DIRECT/212.59.117.39 -
1360667950.122    385 172.16.0.110 TCP_MISS/200 937 GET http://www.prosovet4ik.ru/bitrix/templates/.default/components/skyboom_components/news.detail/.default/style.css? me@MYDOM DIRECT/212.59.117.39 text/css
1360667950.631    894 172.16.0.110 TCP_MISS/200 1697 GET http://www.prosovet4ik.ru/bitrix/templates/prosovet_profy_copy/styles.css? me@MYDOM DIRECT/212.59.117.39 text/css
1360667950.685    858 172.16.0.110 TCP_MISS/200 899 GET http://www.prosovet4ik.ru/bitrix/templates/prosovet_profy_copy/template_styles.css? me@MYDOM DIRECT/212.59.117.39 text/css
1360667950.729    991 172.16.0.110 TCP_MISS/200 1256 GET http://www.prosovet4ik.ru/bitrix/templates/prosovet_profy_copy/components/bitrix/menu/template2/style.css? me@MYDOM DIRECT/212.59.117.39 text/css
/>>>>>>>>>>>>>>>
As we can see, FF tries to load all CSS anonymously, but fails on it. One second later, FF use an Authentication data to get the CSS and got it. (but not applied to the page).


After, (i create new FF profile...) I tried to get XML data from the page. And FF got it from first try:
<<<<<<<<<<<<<<<<
1360673684.792      3 172.16.0.110 TCP_MEM_HIT/200 1653 GET http://www.prosovet4ik.ru/upload/iblock_rss_1.xml me@MYDOM NONE/- text/xml
/>>>>>>>>>>>>>>>

And finally, I try to get the particular CSS data ( http://www.prosovet4ik.ru//bitrix/templates/prosovet_profy_copy/template_styles.css?1354646436 ):
<<<<<<<<<<<<<<<<
1360673092.943      8 172.16.0.110 TCP_DENIED/407 1822 GET http://www.prosovet4ik.ru//bitrix/templates/prosovet_profy_copy/template_styles.css? - NONE/- text/html
1360673093.057    112 172.16.0.110 TCP_MISS/200 899 GET http://www.prosovet4ik.ru//bitrix/templates/prosovet_profy_copy/template_styles.css? me@MYDOM DIRECT/212.59.117.39 text/css
/>>>>>>>>>>>>>>>
Now, FF opened a CSS data instead of SQUID access deny page. (interesting why).


And finally finally, i looked in squid log for DENIED request. Here is couple of days using proxy:
<<<<<<<<<<<
( attachment denied.utf8.LF.log.1 )
/>>>>>>>>>>
There is denied not only CSS files.



Expected results:

When FF is authenticated on proxy, I think, FF must not do any try to anonymously connect to proxy.


Windows:
XP x86 sp3
Firefox:
18.0.2
Proxy:
squid 3.1.18 on Slackware linux server.

Comment 1

[mcarmenzv]

Have you tried other browsers? 
We have the same issue with Internet Explorer 8 and Chrome.

We are using squid 3.1.6.12 ( Debian 6.0.7 ) + kerberos authentication too