Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

Patch #3 for HTTP Digest Auth

#2209

This patches supersedes #2000 Patch for HTTP Digest Authentication URI comparison. The current HTTP Digest authentication seems to be broken in Rails 2.3.1 in my tests in the browser and curl. The tests pass, but it seems to fail real life :)

The new behavior of Rails is that sessions will be turned if they are not referenced in an action. The existing code uses the session_id to make the nonce. In the functional tests, this passes because session_id = "". However, when testing a simple controller in the browser, the session_id is +nil+, and throws an exception when calculating the opaque.

I've added a test to catch this behavior. I've also modified the code as described in #2000 Patch for HTTP Digest Authentication URI comparison to allow a hashed version of the user's credentials to be stored (ha1 hash) as well as the plain text password. This is consistent with the intention of digest auth and the implementation in Apache.

I know this may be too late to get into 2.3, but since HTTP Digest has been advertised as a new feature, I wanted to help make it work.

Reported by Don Parish · March 11th, 2009 @ 06:50 AM

State: resolved
Milestone: 2.x
Assigned to: Pratik Pratik
Importance: none

Activity

  1. Don Parish
    Don Parish

    Cleaned up git commits so changes easier to follow. Patch has 3 commits: fix for earlier commit, support for using digested password, and support for session-less connections.

    March 12th, 2009 @ 02:42 AM

  2. Gregg Kellogg
    Gregg Kellogg

    I think it's important to get these patches in, but there should be a follow up to deal with the potential unavailability of the session_id. This could be done either by promoting nonce, validate_nonce and opaque to ControllerMethods so that they can be overridden, or to create some other method, such as "nonce_seed" that can be implemented by an application to provide a more secure seed than a potentially unavailable session_id. The advantage of promoting nonce is that a truly persistent nonce value could be saved in the database to allow for the intended semantics of Digest Authentication. The OAuth plugin does this, for example. It can default to the existing method.

    March 12th, 2009 @ 06:09 AM

  3. Repository
    Repository
    • State changed from new to resolved

    (from [be7b64b35aac1c9e9063d1d8317f8b1be2a3411c]) Support MD5 passwords for Digest auth and use session_options[:secret] in nonce [#2209 Patch #3 for HTTP Digest Auth state:resolved]

    Signed-off-by: Pratik Naik pratiknaik@gmail.com http://github.com/rails/rails/co...

    March 12th, 2009 @ 02:36 PM