Apache Authentication: Wrong ErrorDocument after user provided wrong credentials and canceled afterwards

Question

We've configured Apache HTTPd to use

• Basic Authentication
• Serve a custom error document

Now, the user gets different results, when canceling the authentication in the first step or after submitting wrong credentials.

Example

The user calls the following URL: "example.com/pageXYZ

Expected behavior

1. Browser shows authentication window
2. User cancels the authentication
3. Correct ErrorDocument is shown (Additional login mask with redirect to pageXYZ)

Wrong(?) behavior

1. Browser shows authentication window
2. User submits wrong credentials
3. Browser shows authentication window again
4. User cancels the authentication
5. Correct ErrorDocument is shown, but without redirect to pageXYZ

Does anyone know this behaviour or can tell, why it is like it is and if it is possible to get the expected behavior in both scenarios.

Answer 1

Okay, just found out, that the problem is within the underlying application and not the Apache HTTPd.

On the first request to deliver the ErrorDocument it does some processing, which isn't done on subsequent requests.