I found a minor issue with Cyberduck that was stopping users from downloading files.
1. User attempts to connect to website that uses basic authentication.
2. Cyberduck starts by sending an HTTP method.
3. Website responds with an HTTP 401 Unauthorized error, and a body "access denied". (According to the RFC, it shouldn't return a body with a HEAD method response, but it does.)
4. Cyberduck sees that it needs to do basic authentication. but assumes that the server is well-behaved and doesn't flush the response buffer.
5. The next request is issued, by Cyberduck, in this case a WebDAV PROPFIND method, and the response comes back. However, since the response buffer wasn't cleared, it gives the error "Garbage in response: access deniedHTTP/1.1 207 Multi-Status" . (The body from the previous respond is prepended to the HTTP header of the next response.)
6. Cyberduck gets very confused and hangs. It just sits there.
The fix for this seems simple enough:: Clear the response buffer after HEAD method requests, just in case a server incorrectly returns a body with the response.