hc-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "bitfire (JIRA)" <j...@apache.org>
Subject [jira] [Comment Edited] (HTTPCLIENT-1489) Multiple, comma-separated challenges in WWW-Authenticate are not recognized
Date Sat, 22 Mar 2014 14:03:44 GMT

    [ https://issues.apache.org/jira/browse/HTTPCLIENT-1489?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13944062#comment-13944062
] 

bitfire edited comment on HTTPCLIENT-1489 at 3/22/14 2:02 PM:
--------------------------------------------------------------

{quote}Such headers will really be fun to parse. I am no longer sure this issue can be resolved
earlier than 4.4{quote}

I don't think it will be *that* hard because challenge parameters *must* have an "=" sign.
To summarize this, the syntax definitions from the RFCs are:

{noformat}
WWW-Authenticate  = "WWW-Authenticate" ":" 1#challenge
auth-param     = token "=" ( token | quoted-string )
quoted-string  = ( <"> *(qdtext | quoted-pair ) <"> )
qdtext         = <any TEXT except <">>
{noformat}

where "1#element" means a comma-separated list of at least one element. So, the header you
posted above is valid.


was (Author: bitfire):
{quote}Such headers will really be fun to parse. I am no longer sure this issue can be resolved
earlier than 4.4{quote}

I don't think it will be *that* hard because challenge parameters *must* have an "=" sign.
The syntax definitions from the RFCs are:

{noformat}
WWW-Authenticate  = "WWW-Authenticate" ":" 1#challenge
auth-param     = token "=" ( token | quoted-string )
quoted-string  = ( <"> *(qdtext | quoted-pair ) <"> )
qdtext         = <any TEXT except <">>
{noformat}

where "1#element" means a comma-separated list of at least one element. So, the header you
posted above is valid.

> Multiple, comma-separated challenges in WWW-Authenticate are not recognized
> ---------------------------------------------------------------------------
>
>                 Key: HTTPCLIENT-1489
>                 URL: https://issues.apache.org/jira/browse/HTTPCLIENT-1489
>             Project: HttpComponents HttpClient
>          Issue Type: Bug
>          Components: HttpClient
>    Affects Versions: 4.3.3
>            Reporter: bitfire
>              Labels: authentication, parsing
>             Fix For: 4.4 Final
>
>
> As per RFC 2616, WWW-Authenticate may contain more than one challenge:
> »User agents are advised to take special care in parsing the WWW- Authenticate field
value as it might contain more than one challenge, or if more than one WWW-Authenticate header
field is provided, the contents of a challenge itself can contain a comma-separated list of
authentication parameters.« [https://tools.ietf.org/html/rfc2616#section-14.47]
> For instance, https://contacts.icloud.com returns such a WWW-Authenticate header:
> > GET / HTTP/1.1
> > Host: contacts.icloud.com
> > Accept: */*
> > 
> < HTTP/1.1 401 Unauthorized
> < ...
> < WWW-Authenticate: X-MobileMe-AuthToken realm="Newcastle", Basic realm="Newcastle"
> The X-MobileMe-AuthToken challenge is recognized by HttpClient, but the Basic challenge
is not. HttpClient logs when sending a GET request to https://contacts.icloud.com:
> [DEBUG] headers - http-outgoing-0 << HTTP/1.1 401 Unauthorized
> [DEBUG] headers - http-outgoing-0 << Date: Fri, 21 Mar 2014 19:20:14 GMT
> [DEBUG] headers - http-outgoing-0 << X-Apple-Request-UUID: d1d0aa7d-d651-4da2-be9f-595f1619db85
> [DEBUG] headers - http-outgoing-0 << X-Responding-Instance: carddav:12100701:st13p21ic-quav11230703:8001:14B52:125783
> [DEBUG] headers - http-outgoing-0 << WWW-Authenticate: X-MobileMe-AuthToken realm="Newcastle",
Basic realm="Newcastle"
> [DEBUG] headers - http-outgoing-0 << Content-Length: 0
> [DEBUG] MainClientExec - Connection can be kept alive indefinitely
> [DEBUG] HttpAuthenticator - Authentication required
> [DEBUG] HttpAuthenticator - contacts.icloud.com:443 requested authentication
> [INFO] TargetAuthenticationStrategy - GOT Auth header: X-MobileMe-AuthToken realm="Newcastle",
Basic realm="Newcastle"
> [DEBUG] TargetAuthenticationStrategy - Authentication schemes in the order of preference:
[negotiate, Kerberos, NTLM, Digest, Basic]
> [DEBUG] TargetAuthenticationStrategy - Challenge for negotiate authentication scheme
not available
> [DEBUG] TargetAuthenticationStrategy - Challenge for Kerberos authentication scheme not
available
> [DEBUG] TargetAuthenticationStrategy - Challenge for NTLM authentication scheme not available
> [DEBUG] TargetAuthenticationStrategy - Challenge for Digest authentication scheme not
available
> [DEBUG] TargetAuthenticationStrategy - Challenge for Basic authentication scheme not
available
> The Basic auth challenge is NOT recognized!
> Reason: org.apache.http.impl.client.AuthenticationStrategyImpl:getChallenges iterates
through the WWW-Authenticate HEADERS but doesn't take account that a single header may contain
multiple challenges.
> How to fix:
> Split and parse the WWW-Authenticate header correctly in org.apache.http.impl.client.AuthenticationStrategyImpl:getChallenges




--
This message was sent by Atlassian JIRA
(v6.2#6252)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org


Mime
View raw message