Re: IO Error: HTTP resource not retrievable. The HTTP status from the remote server was: 401

--JP+T4n/bALQSJXh8
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi Bob,

Bob <[email protected]>, 2015-07-29 13:59 -0400:
> Archived-At: <http://www.w3.org/mid/[email protected]>
>=20
> I'm getting:
>=20
> 1. *IO Error*: HTTP resource not retrievable. The HTTP status from the
>    remote server was: 401.
>=20
> The webpage being tested is protected by username/password that I've
> entered. I've used the validator 1-2 weeks ago on the same domain without
> any problem.
>=20
> Any suggestions?
>=20
> Is this a version (Version: 15.7.26) issue?

The fact that no longer works is by design. The HTML Checker does not
support doing that.

The legacy validator supports that mechanism, by which you can give it a
username and password to do HTTP authentication for a URL at a different
domain (wherever the document you=E2=80=99re checking is hosted).

But that is a very bad idea. Among other reasons, it gives users a false
sense of security in that it looks like they=E2=80=99re just logging into t=
hat
other domain in the same way you normally would.

But you=E2=80=99re not. Instead the legacy validator is MITMing you. It=E2=
=80=99s basically
phishing your credentials. It=E2=80=99s trying to train you that it=E2=80=
=99s OK and safe
to get phished.

Try going to https://validator.w3.org/check?uri=3Dhttp%3A%2F%2Ftest.webdav.=
org%2Fauth-basic%2F
and press the Cancel button in the HTTP authentication prompt, and read
what it says there, especially the following parts:

> You should have been prompted by your browser for a username/password
> pair; if you had supplied this information, I would have forwarded it to
> your server for authorization to access the resource.
>
> You should also be aware that the way we proxy this authentication
> information defeats the normal working of HTTP Authentication. If you
> authenticate to server A, your browser may keep sending the
> authentication information to us every time you validate a page,
> regardless of what server it's on, and we'll happily pass that on to the
> server thereby making it possible for a malicious server operator to
> capture your credentials.

You should never give a password to any third-party site on the Web like
that, ever=E2=80=94No matter how much you trust them not to do anything mal=
icious.

If you choose to take a risk like that, then you might as well just go all
the way and put the username and password into the URL you give to the
checker, like this:

  https://your_username:[email protected]

You can give a URL like that to https://validator.w3.org/nu/ right now and
it will work. But I really don=E2=80=99t recommend actually doing that, bec=
ause it=E2=80=99s
not secure. But at least it=E2=80=99s more clear to you that you=E2=80=99re=
 doing something
insecure, as opposed to what the legacy validator is doing, which is giving
a misleading illusion of security.

It would be less insecure if you ran your own local copy of the checker for
checking sites that require login credentials. You could do that like this:

1. Download the latest release of the validator vnu.jar file from
   https://github.com/validator/validator/releases/latest) or from
   https://sideshowbarker.net/releases/jar/.

2. Run your own local instance of the HTML Checker
   https://validator.github.io/validator/#standalone and give it a
   URL in the form https://your_username:[email protected]

3. or, Use the vnu.jar tool from the command-line
   https://validator.github.io/validator/#usage like this:

     java -jar ~/vnu.jar https://your_username:[email protected]

--=20
Michael[tm] Smith https://people.w3.org/mike

--JP+T4n/bALQSJXh8
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVuXKuAAoJEIfRdHe8OkuVYqQP/ionshZtSA3Q+ofMy7T60fwJ
c2g9h5agpoMMXqzlxP9iRHArcPYEW8wGwXVP2QWGezWyohpTrfyduFxWy1bQYeOh
bKuT1+Ny7OXMmGBWBxErnv8iaW3EnzqZdknHTRPS21RNwnkCRgC4s7wCCpcAROjy
y95Y/kZ/Z4oXrBWWWvzCk25JS8VUAChojA/qGApsyzh1D/31LZTVhIJZc9S82Xdw
TdOd5++3t2xqXYKM5uQrosK9Y44Y5b/WinBDVCY/fZJ2jObQ3CkbCPIuESSt88gm
3RIrTtlszsHitkyqVOgWIPJnfqFLdVycWky8eiQUre6aCowrfTx48aAqNPE7wJ34
O07+HZVuIk0jYSPK+1BaNCMMCuVCdD1wzZCb9bUVC+QyyuNihX0QvyfA3U9ck8es
k1ZkTN9CXogc8/9qNeENWARY7yzThI4m+CmCNDx5RLUXh5ihH8Mj5epWT/XdCO/g
25A64PF2+bplCi3/nnlGz5XpnT5wnPo4e/fkfmxclZDVaJdex2LeIvN2/+wUEvV9
qEZeg/1XuqU568S/oXq/WMNwU4wWgH7aBXJd036ACGl3fbCf5AszJJxsw0kzYrII
usGkULtng063E86YUozmukt7ntk3rtsFvVIcGUHDAntex0M/x4KihpUbBxCFXScS
PYSkdJsrJcP84ZIsXQPu
=2daV
-----END PGP SIGNATURE-----

--JP+T4n/bALQSJXh8--