Subject: [art] Reference Implementation for new HTTP auths?

From: Yutaka OIWA <[email-masked]>
Date: Sat, 16 Nov 2019 09:37:00 +0000

Dear HTTP-AUTH friends,

Do you know is there a good reference implementation or test suites for
revised Basic/Digest authentication (RFC 7617/7616) and/or i18n (RFC 5987)?

We recently implemented a set of library code for these new standards and 
We're looking forward to checking interoperability.
We checked for some limited interoperability with curl or other C-based
implementations using SHA-1, but for i18n or SHA-2 algorithms, 
we were only possible to check with our own server/client implementation pair.

Our code is available in https://github.com/yoiwa/python-httpauth-lib ,
including server/client pair for almost-full-spec RFC 7616 written in Python 3.
These codes are initially implemented for introducing stronger authentication
to our RESTCONF-based applications.

Information and/or suggestions are welcome.

Cheers,

Yutaka

-- 
Yutaka OIWA, Ph.D.          Leader, Software Quality Assurance Research Team
                                     Cyber Physical Security Research Center
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

---

From: Rob Sayre <[email-masked]>
Date: Sat, 16 Nov 2019 13:18:12 -0800

> Information and/or suggestions are welcome.

I don't know of any tests for the newer stuff, but you can build simple
command line clients for both the Chromium and Mozilla networking stacks.

Here's a sample C++ command line client for Chromium:
https://cs.chromium.org/chromium/src/components/cronet/native/sample/main.cc?dr=CSs&g=0

For Mozilla, you can use XPCShell, a JS shell with access to browser
internals such as networking and file i/o.
https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Language_bindings/XPConnect/xpcshell

The test suites for Mozilla, WebKit, and Chromium also contain a lot of
strange edge cases you might want to know about.

For Chromium, look at the http_auth_* files:
https://cs.chromium.org/chromium/src/net/http/?dr=CSs&g=0

For WebKit, look at the basic-auth XHR tests:
https://trac.webkit.org/browser/webkit/trunk/LayoutTests/http/tests/xmlhttprequest

For Mozilla, the tests are in JS. This file also shows how to use httpd.js,
their test server:
https://dxr.mozilla.org/mozilla-central/source/netwerk/test/unit/test_authentication.js#4

There are WHATWG tests for the XHR and Fetch APIs, but they don't look as
detailed as the browser's to me.
https://github.com/web-platform-tests/wpt

There are some relatively detailed compatibility considerations listed here:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate

thanks,
Rob