You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Geoffrey Young <ge...@modperlcookbook.org> on 2004/03/19 19:30:08 UTC
mod_auth_digest and MSIE
hi all...
the MSIE + query string and mod_auth_digest came up again yesterday in
bugzilla:
http://issues.apache.org/bugzilla/show_bug.cgi?id=27758
the issue was discussed here a while ago, most notably in
http://marc.theaimsgroup.com/?t=105510868000001&r=1&w=2
with most people thinking it was a decent enough idea but with little in
terms of a resoltion.
anyway, I (along with a few others in the two threads) are kind of in favor
of giving admins _some_ way to support MSIE + Digest. I like Paul's
original patch but kind of felt that playing with the comparison algorithm
was, well, messier than messing with the individual components. messy in
either case but at least this way if the comparison ever needs to change
there are less parentheses to worry about ;)
so new patch against HEAD is attached. comments, new or changed opinions,
implementation preferences, etc welcome. if the consensus is that the idea
is decent I'll keep reworking patches until everyone is satisfied with the
details.
--Geoff
Re: mod_auth_digest and MSIE
Posted by Geoffrey Young <ge...@modperlcookbook.org>.
Paul Querna wrote:
> On Fri, 2004-03-19 at 16:59, Geoffrey Young wrote:
>
>>it probably needs a better name, though :)
>
> AuthDigestEnableQueryStringHack is a great name.
>
> Its an fugly name for an fugly Hack. I forget who originally suggested
> the name, but I like it.
ok :)
>
> Geoff, I like your approach in that patch. It keeps that huge if() from
> getting any bigger or more complicated.
cool. I'll give it a few more days to marinate, but if nobody complains or
has a better implementation suggestion I'll check it in around tuesday of
next week.
--Geoff
Re: mod_auth_digest and MSIE
Posted by Paul Querna <ch...@force-elite.com>.
On Fri, 2004-03-19 at 16:59, Geoffrey Young wrote:
> it probably needs a better name, though :)
AuthDigestEnableQueryStringHack is a great name.
Its an fugly name for an fugly Hack. I forget who originally suggested
the name, but I like it.
Geoff, I like your approach in that patch. It keeps that huge if() from
getting any bigger or more complicated.
-Paul Querna
Re: mod_auth_digest and MSIE
Posted by Geoffrey Young <ge...@modperlcookbook.org>.
Joshua Slive wrote:
> On Fri, 19 Mar 2004, Edward Rudd wrote:
>
>
>>I do have to question the *idea* of hacking an RFC compliant module to
>>support non RFC behavior?
agreed it's a borderline issue. but if you take the
be-lenient-in-what-you-receive stance it's something that we ought to
support - we may represent the largest server share, but since MSIE
represents the majority of the clients the majority of users can't use
digest auth at all.
and of course there's the security argument, but I find myself wondering if
ignoring the query string by itself is really that insecure, given the
multitude of other hurdles required to pass through the scheme and the fact
that the old digest scheme is still supported (which is all browsers like
opera support anyway, IIRC)
>>
>>Another question would be, IF the hack does make it's way in, I suggest
>>that it should be wrapped around a big IF, so that a configuration
>>directive must be enable to enable the hack. (similar to the
>>mod_auth_ldap MSFrontPage hack)
>
>
> The hack would only be in effect if teh AuthDigestEnableQueryStringHack
> env variable was set (which could happen, for example, using a
> BrowserMatch directive).
right. all the above aside, what we're really giving users is an option to
be tolerant. and I like the suggested approach, as it allows for more
granularity than typical per-directory directives generally provide. it
probably needs a better name, though :)
--Geoff
Re: mod_auth_digest and MSIE
Posted by Joshua Slive <jo...@slive.ca>.
On Fri, 19 Mar 2004, Edward Rudd wrote:
> I do have to question the *idea* of hacking an RFC compliant module to
> support non RFC behavior? I know for Cyrus IMAP their stance is not to
> break with the RFC, but to have the consumers complain to the MUA
> creator to fix their bug. Though this issue has been brought up to MS
> over a year ago, and they still refuse to fix it.
>
> Another question would be, IF the hack does make it's way in, I suggest
> that it should be wrapped around a big IF, so that a configuration
> directive must be enable to enable the hack. (similar to the
> mod_auth_ldap MSFrontPage hack)
The hack would only be in effect if teh AuthDigestEnableQueryStringHack
env variable was set (which could happen, for example, using a
BrowserMatch directive).
Joshua.
Re: mod_auth_digest and MSIE
Posted by Edward Rudd <ed...@omegaware.com>.
I do have to question the *idea* of hacking an RFC compliant module to
support non RFC behavior? I know for Cyrus IMAP their stance is not to
break with the RFC, but to have the consumers complain to the MUA
creator to fix their bug. Though this issue has been brought up to MS
over a year ago, and they still refuse to fix it.
Another question would be, IF the hack does make it's way in, I suggest
that it should be wrapped around a big IF, so that a configuration
directive must be enable to enable the hack. (similar to the
mod_auth_ldap MSFrontPage hack)
On Fri, 19 Mar 2004 13:30:08 -0500, Geoffrey
Young wrote:
> hi all...
>
> the MSIE + query string and mod_auth_digest came up again yesterday in
> bugzilla:
>
> http://issues.apache.org/bugzilla/show_bug.cgi?id=27758
>
> the issue was discussed here a while ago, most notably in
>
> http://marc.theaimsgroup.com/?t=105510868000001&r=1&w=2
>
> with most people thinking it was a decent enough idea but with little in
> terms of a resoltion.
>
> anyway, I (along with a few others in the two threads) are kind of in
> favor of giving admins _some_ way to support MSIE + Digest. I like
> Paul's original patch but kind of felt that playing with the comparison
> algorithm was, well, messier than messing with the individual
> components. messy in either case but at least this way if the
> comparison ever needs to change there are less parentheses to worry
> about ;)
>
> so new patch against HEAD is attached. comments, new or changed
> opinions, implementation preferences, etc welcome. if the consensus is
> that the idea is decent I'll keep reworking patches until everyone is
> satisfied with the details.
>
> --GeoffIndex: modules/aaa/mod_auth_digest.c
> =================================================================== RCS
> file: /home/cvspublic/httpd-2.0/modules/aaa/mod_auth_digest.c,v
> retrieving revision 1.86
> diff -u -r1.86 mod_auth_digest.c
> --- modules/aaa/mod_auth_digest.c 21 Feb 2004 00:53:18 -0000 1.86 +++
> modules/aaa/mod_auth_digest.c 19 Mar 2004 18:20:48 -0000 @@ -1671,8
> +1671,34 @@
> if (d_uri.path) {
> ap_unescape_url(d_uri.path);
> }
> +
> if (d_uri.query) {
> ap_unescape_url(d_uri.query);
> + }
> + else if (r_uri.query) {
> + /* MSIE compatibility hack. MSIE has some RFC issues -
> doesn't + * include the query string in the uri
> Authorization component + * or when computing the response
> component. the second part + * works out ok, since we can
> hash the header and get the same + * result. however, the
> uri from the request line won't match + * the uri
> Authorization component since the header lacks the + * query
> string, leaving us incompatable with a (broken) MSIE. + * +
> * the workaround is to fake a query string match if in the
> proper + * environment - BrowserMatch MSIE, for example.
> the cool thing + * is that if MSIE ever fixes itself the
> simple match ought to + * work and this code won't be
> reached anyway, even if the + * environment is set. +
> */
> +
> + if (apr_table_get(r->subprocess_env, +
> "AuthDigestEnableQueryStringHack")) { +
> + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Digest: "
> +
> "applying
> AuthDigestEnableQueryStringHack");
> +
> + d_uri.query = r_uri.query; + }
> }
> }
> if (r->method_number == M_CONNECT) {