From db6cc1324d04a8d7bb9f5f34d54a6505881dca8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Sat, 29 Aug 2020 18:21:01 +0200
Subject: [PATCH] Do not set WWW-Authenticate on XMLHttpRequest

Client using XMLHttpRequest should manage themselves the authentication.
So by not setting the header, we prevent the browser to raise an authentication
popup.

issue9535
review290791002
---
 trytond/wsgi.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/trytond/wsgi.py b/trytond/wsgi.py
index 24de0b809b..6859d3ba65 100644
--- a/trytond/wsgi.py
+++ b/trytond/wsgi.py
@@ -77,9 +77,10 @@ class TrytondWSGI(object):
         if request.user_id:
             return wrapped(*args, **kwargs)
         else:
-            response = Response(
-                None, http.client.UNAUTHORIZED,
-                {'WWW-Authenticate': 'Basic realm="Tryton"'})
+            headers = {}
+            if request.headers.get('X-Requested-With') != 'XMLHttpRequest':
+                headers['WWW-Authenticate'] = 'Basic realm="Tryton"'
+            response = Response(None, http.client.UNAUTHORIZED, headers)
             abort(http.client.UNAUTHORIZED, response=response)
 
     def check_request_size(self, request, size=None):