We use several wordpress sites internally at work on a server with external web access. Ran into a very odd problem when using HTTP Authentication. By authenticating against the Windows Domain Controller at work, we don’t have to have users create another user name and password, which means things Just Work for the most part.
The problem was that someone would edit a post and the edits would vanish. No error, but their edits would never show up. It didn’t happen when using normal authentication, only with HTTP auth. I was able to verify that it also only happened when someone outside the domain the server and I were both on tried to edit a post.
Contacted the plugin author and he verified he was using his plugin on the same version of wordpress we were on. He got me on the right track by telling me to look for 401 errors in my apache logs. Found a TON of these where calls to wp-cron.php from the servers EXTERNAL ip addres were coming back with authentication failures. (the server has two IP addresses, internal to the domain and public facing).
Here’s what I think was happening: user in another domain would edit a post. As soon as they tried to save, the wordpress install would fire off a call to wp-cron.php from the external IP address of the server (since that’s how the user was accessing the site), which did whatever sort of housekeeping it was supposed to do when a post was edited. This would fail since the wordpress install itself didn’t have any means of authenticating to the Apache server as the user editing the post. (Editing the plugin might be a way around that). With normal cookie authentication, this wasn’t a problem (not sure why not - how does the server authenticate to itself? Or does it not, only when we tell apache to ask for authentication with every page load). So we get an apache error and the post is not saved.
Fix - The support forums for wordpress have comments from moderators suggesting that this is the fault of server admins who block this behavior, and that it is not a security problem. They also mention editing the servers hosts file so it never tries to access itself via the external IP. My personal feeling is that if this is happening enough to make it into the forums, the WP team ought to look at this and find a better way to do it. Anyway, disable the spawn call in wp-includes/cron.php. This seemed to work, although it means you can’t future post. But I would rather do this than mess with the hosts file on the server, which affects all workings, rather than just wordpress itself.