Repository navigation
Digest challenge - realm fails with empty string #56369
Description
The issue is similar to #50283 but this time about realm key. For example:
WWW-Authenticate : Digest realm="", nonce="NjBGRkMxNjUgY2FiN2YxZDM1MWM4ZDAyOTRiMmY2ZGVjOGMxMDY2Zjg=", algorithm="MD5", qop="auth"
will fail with error Nonce missing
RFC7616 says realm SHOULD contain al least the name of the server, but not MUST contain, so it doesn't exclude an empty realm
This string should contain at least the name of the host performing the authentication
and might additionally indicate the collection of users who might have access.
This lines of method Parse in class System.Net.Http.AuthenticationHelper.DigestResponse
// Ensure value is valid.
// Opaque and Domain can have empty string
if (value == string.Empty &&
(!key.Equals(Opaque, StringComparison.OrdinalIgnoreCase) && !key.Equals(Domain, StringComparison.OrdinalIgnoreCase)))
break;should be modified to allow empty Realm value
Activity
karelz commentedon Jul 27, 2021
Triage: Seems legit. Are you interested in submitting PR for it?
Otherwise, moving to 7.0. Should be fairly straightforward to fix.
accept empty realm for digest auth (dotnet#56369)
accept empty realm for digest auth (dotnet#56369)
accept empty realm for digest auth (dotnet#56369)
accept empty realm for digest auth (dotnet#56369)
23 remaining items
karelz commentedon Nov 4, 2021
@bompani will you be able to validate on private (unsigned) binaries that the fix addresses your problem?
bompani commentedon Nov 5, 2021
Yes I'm able to validate on private binaries. Can I download the PR buld or have I to build it myself?
karelz commentedon Nov 5, 2021
Great!
Building it yourself is of course an option.
The PR has build artifacts - libraries_bin_* e.g.:
Grab
System.Net.Http.dll(in directory bin\runtime\net5.0-Windows_NT-Debug-x64 of the zip) and replace it in your local installation (tip: make a copy of the original file first). The debug build should work with locally-installed release build, but I am not 100% sure -- if you hit any problems, let me know (I would build binaries you need locally - I would need the OS/bitness info you need), or you can compile it yourself if you are set up to do that.Run the repro before replacing the binary to make sure it repros and then after you replace the binary to make sure it works correctly with the new bits.
bompani commentedon Nov 5, 2021
I can confirm that the PR build resolves our problem.
Thanks.
karelz commentedon Nov 5, 2021
Thanks for validation @bompani!
Which OS / architecture did you validate? Did you use the build artifacts, or your local build?
bompani commentedon Nov 5, 2021
I validated my local build of branch backport/pr-56455-to-release/5.0 on Windows10/x64
karelz commentedon Nov 5, 2021
Thanks for confirmation @bompani!
[release/5.0] accept empty realm for digest auth (#56369) (#61203)
karelz commentedon Nov 9, 2021
The bug is fixed:
accept empty realm for digest auth (dotnet#56369) (dotnet#56455)