FYI - E71 browser bug in HTTP POST authentication

Question

Some time ago I wrote a simple CGI script to upload photos from my old Nokia 6820. (but as the camera was so awful, I didn't use it much...)
When I tried to use it with my new E71, it didn't work and the browser exited unexpectedly.
When I had a look, it seems I had a public page with a form to upload a file using  POST, then a CGI script that required basic authentication (i.e. a password). The N71 uploaded the file, got a 401 response, then died. Working browsers upload the file, get a 401, pop up a password dialogue, then resubmit the file with an authentication string and get the success response.
This seemed a somwhat crazy way to do it, on reflection, so I moved the form into the CGI directory. Now it works on the N71 - does an authentication step on the GET, and sends the authentication string with the first and only POST request.
(version 100.07.76; says latest for my phone in Canada)

Answer 1

After having read the RFC 4954, I must agree that the RFCs are a bit contradictory in this case.
RFC 2821 states that "all buffers and state tables [are] cleared". RFC 4954 states, that "after an AUTH command [...] no more AUTH commands may be issued [...]".
Taking both statements together, it wouldn't be possible to send two Emails within one authenticated session.
I digged into that a bit deeper, and discovered that some guys already found this contradiction:
http://notabug.com/2002/drums-archive/6812
Unfortunately they simply removed the sentence. Replacing it with a more precise statement would have been much better. Especially the behaviour of the RSET command in authenticated connections should have been descibed.
So the RSET command resets all buffers and state tables of a _transaction_. The buffers and state tables of the _connection_ remain untouched. So the RSET command shouldn't flush an authentication, because it belongs to a _connection_.
Due to this misleading statements, we have some (a lot of) mail servers out there which flush the authentication. So it might be a good idea to take out the RSET command after the AUTH, though Nokia/Symbian implementation is not against the RFCs.
Simply go through the topics, and you will see that a lot of people have problems sending Emails. And they blame their Nokia, because all other mail clients work flawless.
So I agree: An RSET directly after an AUTH shouldn't do any harm. But in reality it does - due to misleading RFCs and therefore incorrect server implementations. And as you say, RSET doesn't make much sense there, so it should be removed.
Kreye