Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

Patch to fix broken HTTP Digest Authentication

#1848

Found a problem while trying to use http digest authentication at http://ryandaigle.com/articles/2... The digest authentication failed using both IE and FireFox. The current implementation is using the actual URI from the request instead of the URI passed in the authentication header, which is stored in the credentials hash. It seems as if the client is responsible for the URI passed in. It could be an absolute URI, as suggested in http://tools.ietf.org/html/rfc2617, but every example I've seen, only the relative path is used.

With the attached change, the tests pass, and the digest authentication work with my test controller using IE and FireFox on Windows.

Reported by Don Parish · February 2nd, 2009 @ 09:30 PM

State: resolved
Milestone: 2.3.4
Assigned to: Pratik Pratik
Importance: none

Activity

  1. Don Parish
    Don Parish
    • Tag changed from authentication, bug, digest, patch to 2.3, authentication, bug, digest, patch
    • Title changed from HTTP Digest Authentication Broken to Patch to fix broken HTTP Digest Authentication

    February 2nd, 2009 @ 10:49 PM

  2. Don Parish
    Don Parish

    Updated the patch with a test.

    February 4th, 2009 @ 09:51 PM

  3. DHH
    DHH
    • Assigned user set to Pratik
    • Milestone cleared.

    February 5th, 2009 @ 07:15 PM

  4. Don Parish
    Don Parish

    Updated patch to include test. This patch is also posted at #1230 Implement HTTP Digest authentication.

    February 5th, 2009 @ 11:09 PM

  5. Repository
    Repository
    • State changed from new to resolved

    (from [86d8f922828677e64892c166adf26cd421f0991a]) Fixed http digest authentication to use credentials URI passed from client. [#1848 Patch to fix broken HTTP Digest Authentication state:resolved]

    Signed-off-by: Pratik Naik pratiknaik@gmail.com http://github.com/rails/rails/co...

    February 16th, 2009 @ 07:24 PM

  6. José Valim
    José Valim

    HTTP digest still does not work on Rails master neither v2.3.3 on Firefox.

    Apparently, this changed got lost on both, although the test is there. But since it still pass, it means that it was not testing the proper thing.

    July 17th, 2009 @ 04:17 PM

  7. Pratik
    Pratik
    • Milestone set to 2.3.4
    • State changed from resolved to open

    July 18th, 2009 @ 10:38 AM

  8. Pratik
    Pratik

    Jose, do you have the fix ?

    Thanks.

    July 18th, 2009 @ 10:38 AM

  9. José Valim
    José Valim

    I will work on a patch during the weekend!

    July 18th, 2009 @ 11:08 AM

  10. José Valim
    José Valim

    @pratik, here goes the patch.

    And we have two problems:

    • Some servers, as webrick, gives the full url in REQUEST_URI. If a browser (as Safari) give the relative uri in credentials, http digest won't work.

    • And as @donparish said some browsers can give the full url in credentials, not matching if the server uses the relative uri.

    The patch solves both cases by checking if the credential given is a path or full uri (i.e. if it starts with "/" or not). I've also added tests for each of those combinations.

    I tested in "real life" with Firefox on Linux on both webrick and thin. Would be nice if some tests would be executed with Safari and IE with both servers.

    July 19th, 2009 @ 10:17 AM

  11. José Valim
    José Valim

    Apparently the problem with S3 and Lighthouse is not yet fixed.
    Here is the patch: http://pastie.org/551062

    July 19th, 2009 @ 10:20 AM

  12. José Valim
    José Valim
    • State changed from open to resolved

    I've moved the new ticket to #3006 Patch to fix broken HTTP Digest Authentication for bugmash purposes.

    August 8th, 2009 @ 11:57 AM