Open
Conversation
It is allowed to provide multiple authentication schemes with optional challenges in the WWW-Authenticate headers. This fixes that it always took the first scheme, and thus failed on a header such as: WWW-Authenticate: NTLM, Digest .... Also frameworks such as Faraday group multiple WWW-Authenticate headers in a response, for example WWW-Authenticate: Digest ... WWW-Authenticate: NTLM into: WWW-Authenticate: Digest ..., NTLM so there is a single way of retrieving header data. This commit changes the parser to pick out only the digest challenge part and the authentication parameters until it encounters another scheme (if any).
This allows for HTTP servers to provide headers where the challenge parameter values are unquoted or when there is no spacing after the parameter separator.
Author
|
It might also be a good idea to throw |
Open
Owner
|
I think an exception that is understandable is better than NoMethodError for undiagnosable reasons |
This also includes the case where there is no Digest authentication in the auth header at all. Adds a small remark about this to the documentation of Net::HTTP::DigestAuth#auth_header.
Author
|
I added a commit that raises a |
|
Please accept this pull request, I believe it addresses |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This branch improves and fixes the parsing of the challenge in the header. It fixes a crash if there are multiple authentication schemes in the header and it adds some robustness for HTTP servers that are not completely compliant with RFC 2617.
Parsing/regexps are inspired by RFC 2617: https://tools.ietf.org/html/rfc2617#section-3.2.1.