After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 544681 - Digest authentication should default to MD5-digest
Digest authentication should default to MD5-digest
Status: RESOLVED FIXED
Product: libsoup
Classification: Core
Component: HTTP Transport
2.4.x
Other All
: Normal major
: ---
Assigned To: libsoup-maint@gnome.bugs
libsoup-maint@gnome.bugs
Depends on:
Blocks:
 
 
Reported: 2008-07-25 12:45 UTC by Mads Chr. Olesen
Modified: 2008-07-26 13:19 UTC
See Also:
GNOME target: ---
GNOME version: 2.21/2.22

Attachments
Select MD5 as default digest algorithm (593 bytes, patch)
2008-07-25 12:46 UTC, Mads Chr. Olesen 		none Details | Review

Description Mads Chr. Olesen 2008-07-25 12:45:28 UTC 
Please describe the problem:
If the server doesn't return an algorithm in the headers, e.g.
"""
HTTP/1.1 401 Authorization Required

Date: Mon, 19 May 2008 12:54:30 GMT

Server: Apache

WWW-Authenticate: Digest realm="www.xxx.dk", nonce="8192d3c589fb0e673b81a7d873f04f641211201670"

Transfer-Encoding: chunked

Content-Type: text/html; charset=iso-8859-1
"""

libsoup will default to a "NONE" authentication, which later in the function "soup_auth_digest_compute_hex_a1" makes it use MD5-SESS. This is very wrong. RFC-2617 states (about the algorithm directive) that "If this is not present it is assumed to be "MD5"".

Please see attached patch.

Steps to reproduce:
1. Connect to webdav server, e.g. using gvfs, that does not transmit "algorithm" directive
2. Fail, due to wrong auth digest.

Actual results:


Expected results:


Does this happen every time?
Yes

Other information:
Comment 1 Mads Chr. Olesen 2008-07-25 12:46:22 UTC 
Created attachment 115245 [details] [review]
Select MD5 as default digest algorithm
Comment 2 Dan Winship 2008-07-26 13:19:44 UTC 
This problem has been fixed in the development version. The fix will be available in the next major software release. Thank you for your bug report.