Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got an Apache2 httpd running in front of a Tomcat, doing authentication via mod_auth_kerb.

When I open the console in Firebug, I see lots of 401's (see screenshot:

Is there a way to avoid this? I guess its causing an additional roundtrip which impacts performance.

share|improve this question
up vote 1 down vote accepted

No; the extra response and request are necessary for the SPNEGO authentication process, see RFC 4559 for details.

I'd recommend only forcing authentication of the sensitive resources. In your screenshot, it looks like only that very first request should be authenticated; you can probably set Satisfy Any on that /res directory.

share|improve this answer
Yeah, excluding those resources might be a solution. I was testing this in Firefox, so there was no IE SSO stuff going on. Credentials were collected via HTTP BASIC style prompt, so I was expecting that the browser would send the "Authorize" header preemptively for all URLs it tried to fetch, just like with traditional HTTP BASIC auth. Do you know why the Kerberos blob is not sent preemptively? – Michael Böckling Nov 22 '11 at 21:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.