Casey Duncan <casey@zope.com> writes: > The server returns a 200 response status. Strangly, the response > headers do include WWW-Authenticate. So, the xml-rpc code must be > changing the response status. Yes. It's probably this piece in ZPublisher/xmlrpc.py: --cut-- # Do the damage. self.setBody(f) self._real.setStatus(200) --cut-- Damage, indeed :-) or better :-(