You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Paul Querna <ch...@cyan.com> on 2003/06/08 23:43:08 UTC
[PATCH] mod_auth_digest.c -- EnableQueryStringHack
MSIE breaks Digest authentication whenever there is a GET Query string. This
is noted in the httpd manual, but provides no work around. By my reading of
the RFCs we do use the correct implmentation, and most other browsers follow
it. But because MSIE does not follow it, it prevents the widespread use of
Digest authentication over Basic authentication.
This Patch is setup to use a BrowserMatch directive to allow MSIE clients to
use Digest Authentication.
All I have added to my httpd.conf is:
BrowserMatch MSIE AuthDigestEnableQueryStringHack=on
Example URLs:
http://www.force-elite.com:4080/cgi-bin/printenv
*Digest Authentication w/o extra query string. (always worked in most browsers.)
http://www.force-elite.com:4080/cgi-bin/printenv?&arg1=blah&arg2=afdjkh
*Digest Authentication w/ extra query string. (broken in MSIE w/o patch)
u/p: test/test
The usernames and passwords that can be used are controled by the
mod_authn_dbi demo page... so anyone can change them:
http://www.in.force-elite.com:4080/
This patch is against the HEAD of mod_auth_digest. I can make a patch against
the version in the 2.0 branch if no one else does.
Patch:
http://open.cyanworlds.com/~chip/mod_auth_digest.c-QueryStringHack.patch
--- mod_auth_digest.c 13 Feb 2003 02:28:57 -0000 1.79
+++ mod_auth_digest.c 8 Jun 2003 21:40:10 -0000
@@ -1634,6 +1634,7 @@
request_rec *mainreq;
const char *t;
int res;
+ int query_string_hack;
/* do we require Digest auth for this URI? */
@@ -1715,6 +1716,12 @@
if (d_uri.query) {
ap_unescape_url(d_uri.query);
}
+ if(apr_table_get(r->subprocess_env, "AuthDigestEnableQueryStringHack")){
+ query_string_hack = 0;
+ }
+ else {
+ query_string_hack = 1;
+ }
if (r->method_number == M_CONNECT) {
if (strcmp(resp->uri, r_uri.hostinfo)) {
@@ -1742,9 +1749,9 @@
&& !(d_uri.path && !r_uri.path && resp->psd_request_uri->hostname
&& d_uri.path[0] == '*' && d_uri.path[1] == '\0'))
/* check that query matches */
- || (d_uri.query != r_uri.query
+ || ( query_string_hack && (d_uri.query != r_uri.query
&& (!d_uri.query || !r_uri.query
- || strcmp(d_uri.query, r_uri.query)))
+ || strcmp(d_uri.query, r_uri.query))))
) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"Digest: uri mismatch - <%s> does not match "
-chip
Re: [PATCH] mod_auth_digest.c -- EnableQueryStringHack
Posted by Paul Querna <ch...@cyan.com>.
On Mon, 9 Jun 2003 04:07:02 +0200, André Malo wrote
> Just my opinion: I don't like it very much, since it decreases
> security and violates the RFC very hard. The Client should be fixed,
> not the server. ....but I won't stand in the way if there are
> positive votes on it.
The security is only lessoned when:
1) The Initial URI compare fails (so if IE fixes this in the future, it
wouldn't even hit this code)
2) a BrowserMatch is made (in my patch)
The Changes allow a URI to match even if the Query string does not. It still
checks all other elements of the URI. This is a *very* small price to pay
when you condier the only other option is to use Basic Authentication.(clear
text passwords... etc.)
Microsoft seems to have little motivation to fix their implmentation, but in
the meantime digest authentication is rendered mostly useless. Yes, if you
can control the client side it is a non-issue, but the fact of life is that
the majority of the people on the internet do use Internet Explorer.
I think putting somthing like this patch in is the better of two evils. It
would allow a widerspread use of digest authentication over basic auth, but
yes it would be slightly less secure than the full implmentation of digest for
users of Microsoft's buggy IE. However I think this change is very valuable
for many sites that would like to use a more secure authentication system
without trying todo everything over HTTPS.
Seriously. How much difference will a slightly mismatched URI matter when you
consider how a digest auth is done?
I think the security implications are well worth the cost to even allow IE
clients to use digest authentication. Otherwise Digest will never see
widespread use. ever.
-chip
Re: [PATCH] mod_auth_digest.c -- EnableQueryStringHack
Posted by Joshua Slive <jo...@slive.ca>.
On Sun, 8 Jun 2003, Cliff Woolley wrote:
> On Mon, 9 Jun 2003, [ISO-8859-1] Andr� Malo wrote:
>
> > Just my opinion: I don't like it very much, since it decreases security and
> > violates the RFC very hard. The Client should be fixed, not the server.
> > ...but I won't stand in the way if there are positive votes on it.
>
> Well, part of the reason I said we should go back and look is that I
> seem to recall at least one person voicing exactly that same opinion the
> last time this came up -- and there might have been an actual veto.
> --Cliff
Does anyone know why MS hasn't fixed this? This problem has been well
known for quite some time now.
Considering the fact that we don't want to discourage people from using
digest, even if the client implimentation is buggy, I might be tempted to
accept the patch, but name the env variable something sufficiently nasty,
like MSIE_DIGEST_SECURITY_HOLE.
Joshua.
Re: [PATCH] mod_auth_digest.c -- EnableQueryStringHack
Posted by Cliff Woolley <jw...@virginia.edu>.
I found at least the following two threads:
http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=101702475008999&w=2
http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=104014871203110&w=2
The first of those threads also refers to PR#7063, submitted 1/13/01:
http://bugs.apache.org/index.cgi/full/7063
--Cliff
Re: [PATCH] mod_auth_digest.c -- EnableQueryStringHack
Posted by Cliff Woolley <jw...@virginia.edu>.
On Mon, 9 Jun 2003, [ISO-8859-1] Andr� Malo wrote:
> Just my opinion: I don't like it very much, since it decreases security and
> violates the RFC very hard. The Client should be fixed, not the server.
> ...but I won't stand in the way if there are positive votes on it.
Well, part of the reason I said we should go back and look is that I seem
to recall at least one person voicing exactly that same opinion the last
time this came up -- and there might have been an actual veto.
--Cliff
Re: [PATCH] mod_auth_digest.c -- EnableQueryStringHack
Posted by André Malo <nd...@perlig.de>.
* Cliff Woolley wrote:
> On Sun, 8 Jun 2003, Paul Querna wrote:
>
>> This Patch is setup to use a BrowserMatch directive to allow MSIE
>> clients to use Digest Authentication.
>
> That's strange... I'd have sworn somebody already submitted just such a
> patch. Might do us well to look back in the archives and find out what
> ever happened with that.
Just my opinion: I don't like it very much, since it decreases security and
violates the RFC very hard. The Client should be fixed, not the server.
...but I won't stand in the way if there are positive votes on it.
nd
--
$_=q?tvc!uif)%*|#Bopuifs!A`#~tvc!Xibu)%*|qsjou#Kvtu!A`#~tvc!KBQI!)*|~
tvc!ifmm)%*|#Qfsm!A`#~tvc!jt)%*|(Ibdlfs(~ # What the hell is JAPH? ;
@_=split/\s\s+#/;$_=(join''=>map{chr(ord( # André Malo ;
$_)-1)}split//=>$_[0]).$_[1];s s.*s$_see; # http://pub.perlig.de/ ;
Re: [PATCH] mod_auth_digest.c -- EnableQueryStringHack
Posted by Cliff Woolley <jw...@virginia.edu>.
On Sun, 8 Jun 2003, Paul Querna wrote:
> This Patch is setup to use a BrowserMatch directive to allow MSIE
> clients to use Digest Authentication.
That's strange... I'd have sworn somebody already submitted just such a
patch. Might do us well to look back in the archives and find out what
ever happened with that.
--Cliff