With asynchronous session and deferred message authentication (pause, wait user input, auth, unpause) the number of SoupSession::authenticate signal emissions per authorization required response increases once for every time incorrect credentials are given. (First attempt one signal, second attempt two signals, third attempt three signals, ...)

The culprit would appear to be soup-auth-manager.c (session_request_started) which is not handling requeued messages correctly and is calling soup_message_add_status_code_handler() for the same message again, leading to the problem described above.

A simple if (!g_object_get_data (G_OBJECT (msg), "already-done")) - g_object_set_data (G_OBJECT (msg), ...) in that function would take care of the issue, but I'm wondering if there would be cleaner way to handle the state.