Subject: Digest Authentication (Broken in many Browsers)

From: "John C. Mallery" <[email-masked]>
Date: Wed, 12 Jul 2006 14:47:59 +0000

Few browsers seem to have implemented HTTP 1.1 Digest Authentication  
correctly, at least on the Mac.

Digest authentication of proxy requests seems to be a major problem  
area.

Firefox 2.0b1 seems to be the best implementation on the mac.

1. I note, however, that it computes the digest based on the relative  
URI of the absolute URI requested of the proxy.

RFC 2617 says that the uri should be digest-uri-value = request- 
uri   ; As specified by HTTP/1.1

RFC 2616 says that that the Request-URI    = "*" | absoluteURI |  
abs_path | authority

Further, RFC 2617 says: "The authenticating server must assure that  
the resource designated by the "uri" directive is the same as the  
resource specified in the Request-Line; if they are not, the server  
SHOULD return a 400 Bad Request error."

On my reading of the specs, this is a bug.

What do people think?

Should the specification be clarified in this regard?

What should be done about backward compatibility for buggy clients?

2. If the absoluteURI is used, there is an issue of cannonicalizing  
the case of the scheme, host, and any escape codes.

These are not treated by RFC 2617.

Comments?

---

From: Scott Lawrence <[email-masked]>
Date: Wed, 12 Jul 2006 14:11:36 -0400

> On my reading of the specs, this is a bug.

I'm not sure what 'this' you are referring to...

> What should be done about backward compatibility for buggy clients?

besides fixing the buggy clients?

-- 
Scott Lawrence
http://skrb.org/scott/

---

From: "John C. Mallery" <[email-masked]>
Date: Wed, 12 Jul 2006 18:25:14 +0000

On Jul 12, 2006, at 11:42 AM, Joe Orton wrote:

> On Wed, Jul 12, 2006 at 02:47:59PM +0000, John C. Mallery wrote:
> I think this is a post-1.5 regression in Firefox,

Actually, this is similarly broken in firefox 1.5 and Mozilla too.

> we had a similar
> report with similar details filed against mod_auth_digest:
>
> http://issues.apache.org/bugzilla/show_bug.cgi?id=37959

Did they ever fix it?

---

From: Joe Orton <[email-masked]>
Date: Wed, 12 Jul 2006 16:42:11 +0100

> URI of the absolute URI requested of the proxy.

I think this is a post-1.5 regression in Firefox, we had a similar 
report with similar details filed against mod_auth_digest:

joe