Access denied failure during mid-session authz revocation

Path-based Authorization and Credential Persistence

Apache Subversion implements least-privilege access via path-based authorization (authz) files, which decouple identity verification from directory-level permissions. While the authentication provider handles the initial identity check, the authz file determines the specific read/write capabilities for each repository path.

Credential Cache Uncertainty

A technical uncertainty exists regarding the behavior of the SVN client when server-side permissions are revoked mid-session. Because the client often caches credentials to avoid repeated authentication prompts, it is unclear how the system handles the transition when a user's access is stripped from the authz configuration while a working copy is still active.

The interaction between the client-side credential store and the server's permission re-evaluation varies between the svnserve daemon and mod_dav_svn. It is not explicitly documented whether a change in the authorization file immediately triggers an access-denied response for the next operation or if the session persists until the cache expires.

• Does the SVN client trigger a re-authentication challenge immediately after a server-side authz revocation?
• How does the mod_dav_svn backend signal the client to invalidate cached credentials when path-based permissions change?