This project is archived and is in readonly mode.
HTTP Digest authentication raise an exception if the client fails to include a nonce
The HTTP Digest authentication will raise an exception, and return a 500, if the client fails to include a nonce key/value in the Authorization header value. Rather than raise an exception it should simply return 401.
This also happens if the client specifies Basic authentication credentials. Again, it should return 401 rather than 500.
The fix is a single line check. Tests included.
-
missing_nonce.patch
3.26 KB
-
Michael Koziarski- Assigned user set to Michael Koziarski
- Milestone set to 2.3.4
-
-
CancelProfileIsBroken- Tag changed from actionpack, digest, http_authentication, patch, tested to actionpack, bugmash, digest, http_authentication, patch, tested
- Milestone cleared.
- Assigned user cleared.
-
Repository
- State changed from new to resolved
(from [fdf356d74b9054d44f23356051dd3a85ee9a83b3]) Fixed HTTP digest to properly return 401 when the Authorization header has no nonce specified, or the Authorization header specifies Basic auth [#2968 HTTP Digest authentication raise an exception if the client fails to include ... state:resolved] http://github.com/rails/rails/commit/fdf356d74b9054d44f23356051dd3a...