Merge pull request #1517 from billyrrr/fix/unauthorized-init

Fix #1516 initialization of Unauthorized with www_authenticate=None

Author: davidism

CHANGES.rst

@@ -9,6 +9,8 @@ Unreleased
     Python 2.7. (:issue:`1080`)
 -   Restore the ``response`` argument to :exc:`exceptions.Unauthorized`.
     (:pr:`1527`)
+-   :exc:`exceptions.Unauthorized` doesn't add the ``WWW-Authenticate``
+    header if ``www_authenticate`` is not given. (:issue:`1516`)
 -   The default URL converter correctly encodes bytes to string rather
     than representing them with ``b''``. (:issue:`1502`)
 
@@ -38,7 +40,7 @@ Version 0.15.1
 
 Released 2019-03-21
 
--   :class:`~exceptions.Unauthorized` takes ``description`` as the first
+-   :exc:`~exceptions.Unauthorized` takes ``description`` as the first
     argument, restoring previous behavior. The new ``www_authenticate``
     argument is listed second. (:issue:`1483`)
 

src/werkzeug/exceptions.py

@@ -251,7 +251,12 @@ class Unauthorized(HTTPException):
     :param www-authenticate: A single value, or list of values, for the
         WWW-Authenticate header.
 
-    .. versionchanged:: 0.15.2
+    .. versionchanged:: 0.15.3
+        If the ``www_authenticate`` argument is not set, the
+        ``WWW-Authenticate`` header is not set.
+
+    .. versionchanged:: 0.15.3
+        The ``response`` argument was restored.
 
     .. versionchanged:: 0.15.1
         ``description`` was moved back as the first argument, restoring
@@ -272,8 +277,11 @@ class Unauthorized(HTTPException):
 
     def __init__(self, description=None, response=None, www_authenticate=None):
         HTTPException.__init__(self, description, response)
-        if not isinstance(www_authenticate, (tuple, list)):
-            www_authenticate = (www_authenticate,)
+
+        if www_authenticate is not None:
+            if not isinstance(www_authenticate, (tuple, list)):
+                www_authenticate = (www_authenticate,)
+
         self.www_authenticate = www_authenticate
 
     def get_headers(self, environ=None):

tests/test_exceptions.py

@@ -110,3 +110,7 @@ def test_unauthorized_www_authenticate():
     exc = exceptions.Unauthorized(www_authenticate=[digest, basic])
     h = dict(exc.get_headers({}))
     assert h["WWW-Authenticate"] == ", ".join((str(digest), str(basic)))
+
+    exc = exceptions.Unauthorized()
+    h = dict(exc.get_headers({}))
+    assert "WWW-Authenticate" not in h