Mailing-List: contact dev-help@hc.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "HttpComponents Project" <dev@hc.apache.org>
Date: Fri, 20 Oct 2017 09:53:00 +0000 (UTC)
From: "ASF subversion and git services (JIRA)" <jira@apache.org>
To: dev@hc.apache.org
Message-ID: <JIRA.13079300.1497298145000.16842.1508493180285@Atlassian.JIRA>
In-Reply-To: <JIRA.13079300.1497298145000@Atlassian.JIRA>
References: <JIRA.13079300.1497298145000@Atlassian.JIRA> <JIRA.13079300.1497298145577@jira-lw-us.apache.org>
Subject: [jira] [Commented] (HTTPCLIENT-1855) Digest auth: Nonce counter not
 incremented after reuse
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Fri, 20 Oct 2017 09:53:10 -0000


    [ https://issues.apache.org/jira/browse/HTTPCLIENT-1855?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16212441#comment-16212441 ] 

ASF subversion and git services commented on HTTPCLIENT-1855:
-------------------------------------------------------------

Commit ba47719c3adcc328fd800296ab5189d965ee216c in httpcomponents-client's branch refs/heads/4.6.x from [~olegk]
[ https://git-wip-us.apache.org/repos/asf?p=httpcomponents-client.git;h=ba47719 ]

HTTPCLIENT-1855: disabled caching of DIGEST auth scheme instances due to unreliability of nonce counter when the auth cache is shared by multiple sessions


> Digest auth: Nonce counter not incremented after reuse
> ------------------------------------------------------
>
>                 Key: HTTPCLIENT-1855
>                 URL: https://issues.apache.org/jira/browse/HTTPCLIENT-1855
>             Project: HttpComponents HttpClient
>          Issue Type: Bug
>          Components: HttpClient (classic)
>    Affects Versions: 4.5.2
>            Reporter: Alessandro Gherardi
>         Attachments: HttpClient5Digest.java, HttpClientDigest.java, httpclient5.log, wireshark.txt
>
>
> I have a client app using httpclient 4.5.2 with BasicCredentialsProvider and BasicAuthCache. and web server that requires HTTP digest authentication. 
> The client sends 3 requests to the web server. 
> When the app sends the first request, the server returns an HTTP 401 with a digest challenge. httpclient automatically retries the request with the Authorization header. The header contains the nonce returned by the server and a nonce counter (nc) of 1. The retry succeeds and httpclient caches the DigestScheme.
> For the second request, httpclient uses the cached DigestScheme to calculate the Authorization header pre-emptively. The header contains the same nonce and specifies a nonce counter of 2. The request succeed without requiring a retry.
> For the third request, httpclient uses the cached DigestScheme to calculate the Authorization header pre-emptively. Even though the header contains the same nonce, the nonce counter is set to 2 again. This causes the server to return a 401. httpclient should have incremented the nonce counter to 3.
> I believe that the root cause of this problem is that, although DigestScheme increases the nonceCount field every time the authenticate() method is called, HttpAuthenticator does not re-cache DigestScheme after reusing it. The re-cache is needed because BasicAuthCache stores DigestScheme in serialized format.


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org