203813 - Digest auth does not work with SSL proxy

Status: RESOLVED FIXED

(Core :: Networking, defect, P2)

Description

[Gernot Tenchio]

User-Agent:       Mozilla/5.0 Galeon/1.2.10 (X11; Linux i686; U;) Gecko/20030429
Build Identifier: Mozilla/5.0 Galeon/1.2.10 (X11; Linux i686; U;) Gecko/20030429

While authenticating thru a proxy with digest MD5 the first Response for a POST
Request is calculated wrong. The Browser sends "Request-Method: POST" while
calculating the H(A2) with Method GET.

Reproducible: Always

Steps to Reproduce:
1. Authenticate to an Proxy who forces Digest MD5
2. Try to send an POST Request
3.
Actual Results:  
The Browser prompts for username/password (provided that the proxy doesnt work
around)

Expected Results:  
calculate the first Response with POST instead of GET

Actually I don't know a proxy that supports Authentication Digest. I found that
out while developing my own Proxy. Any other Browser I've tried works as
expected (at least in that situation).

Additionally I think there is an other issue with Authentication. RFC2617 says:

The user agent MUST choose to use one of the challenges with the strongest
auth-scheme it understands... etc.pp.

Actually none of the tested Browsers does so.

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

no need to keep this bug confidential...

Comment 2

[benc]

So this is a problem specifically w/ proxy-auth using digest in a certain
situation? Is there any possibility the problem is more general?

Comment 3

[Gernot Tenchio]

I think it could also happen while authenticating to a server but I haven't
tested it so far. I will do so when time permits. Would it help if I send my
proxies debugging messages?

Comment 4

[benc]

that would be great. long logs should be in an attachment. (so few people admin
their proxies now, I often forget to ask!)

Comment 5

[Gernot Tenchio]

Attachment: debug messages

Ok, this is what the proxy says. Look at the end, after recalculating the
expected response with GET instead of POST everything is ok.

Comment 6

[Gernot Tenchio]

Mozilla shows the same behavior when connecting to a SSL Server. The response is
calculated with GET instead of CONNECT.

Comment 7

[Darin Fisher]

hmm.. i thought that this should be fixed. maybe the CONNECT vs GET case is not,
but as for the POST vs GET case, i thought it was fixed in bug 155155.

Comment 8

[Gernot Tenchio]

Ok, I recompiled my mozilla 1.3 with the bugfix from 155155. The POST vs GET
case is fixed but the CONNECT vs GET case is not. More than this, the CONNECT vs
GET case is now a CONNECT vs GET/POST case.

Comment 9

[Suresh]

Getnot: Is it possible for you to post the testcase in this bug? thanks!

Comment 10

[Darin Fisher]

Attachment: v1 patch

this patch solves the problem by having nsHttpDigestAuth check for proxy-auth
and a HTTPS channel.  if those conditions are met, then it assumes the method
is CONNECT.

Comment 11

[Darin Fisher]

Comment on attachment 122604 [details] [diff] [review]
v1 patch

straightforward patch.	includes these changes:

1- make nsHttpDigestAuth check for HTTPS and proxy-auth.  if conditions met,
then assume method is CONNECT. else method is nsIHttpChannel::requestMethod.

2- fix small bug in SetAuthorizationHeader in which |ident| was not be assigned
in the basic auth case.  this would result in an extra server trip if the user
identity happened to be invalid.

3- minor footprint improvements in nsHttpDigestAuth since i happened to be
touching the file.

Comment 12

[Darin Fisher]

nominating for 1.4 beta.  this patch fixes a bug that prevents digest auth from
working correctly with SSL proxies.  this is not a regression.  we've had this
bug ever since digest auth was initially added to mozilla.

Comment 13

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 122604 [details] [diff] [review]
v1 patch

+			    in boolean	      aProxyAuth,

it would maybe be nice to document this parameter (both places)

Comment 14

[Suresh]

Comment on attachment 122604 [details] [diff] [review]
v1 patch

r-suresh!

nit: please add a comment about aProxyAuth in nsIHttpAuthenticator.idl. thanks!

Comment 15

[Suresh]

biesi beat me to that ;-)

Comment 16

[Darin Fisher]

comments added to my local tree.. thx for noticing that guys!

Comment 17

[Darin Fisher]

Attachment: v1.1 patch

actually, that last patch didn't work... this one does ;-)

tested against an apache v2 proxy server (mod_proxy) with digest auth.

Comment 18

[Darin Fisher]

test proxy server is "foo:[e-mail]:80"

Comment 19

[Suresh]

Comment on attachment 122649 [details] [diff] [review]
v1.1 patch

looks good to me. Also, I tested this patch and it works fine.

r-suresh.

Comment 20

[Darin Fisher]

Comment on attachment 122649 [details] [diff] [review]
v1.1 patch

alec: can you please review this patch.  i'm hoping to land this for 1.4 final.
 thx!

Comment 21

[Gernot Tenchio]

mozilla1.4beta + v1.1 patch

looks good

Comment 22

[Alec Flett]

Comment on attachment 122649 [details] [diff] [review]
v1.1 patch

sr=alecf

Comment 23

[Darin Fisher]

Comment on attachment 122649 [details] [diff] [review]
v1.1 patch

seeking drivers approval for 1.4 final.. fixes an important bug (digest auth
not working with SSL proxies).	patch is relatively low risk.

Comment 24

[Asa Dotzler [:asa]]

Comment on attachment 122649 [details] [diff] [review]
v1.1 patch

a=asa (on behalf of drivers) for checkin to 1.4.

Comment 25

[Darin Fisher]

fixed-on-trunk