mirror of
https://github.com/apache/httpd.git
synced 2026-10-23 22:49:01 +03:00
6aa1bce467
* modules/aaa/mod_auth_digest.c (add_auth_info): Add the (Proxy-)Authentication-Info header to err_headers_out, so a one-time nonce client gets its nextnonce after an error response rather than a stale re-challenge. (note_digest_auth_failure): Drop any (Proxy-)Authentication-Info when issuing a challenge, so a post-authentication 401 carries only the fresh nonce. * test/modules/aaa/test_011_authinfo_errors.py: New tests. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> GitHub: closes PR #739 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937888 13f79535-47bb-0310-9956-ffa450edef68
88 lines
4.3 KiB
Python
88 lines
4.3 KiB
Python
"""Authentication-Info survives an error response.
|
|
|
|
The header is added at fixups, so unless it goes into err_headers_out it
|
|
is dropped when the response turns into an error, costing a one-time-nonce
|
|
client the nextnonce and forcing a stale re-challenge. A 404 for a missing
|
|
file inside the protected area reaches the error path while fully
|
|
authenticated, so it exercises this without a handler like mod_dav.
|
|
"""
|
|
|
|
from . import digest_client as dc
|
|
from .env import AAATestEnv
|
|
|
|
|
|
class TestAuthInfoOnError:
|
|
|
|
def url(self, env, location, path):
|
|
return env.mkurl("http", "aaa", f"/digest/{location}/{path}")
|
|
|
|
def uri(self, location, path):
|
|
return f"/digest/{location}/{path}"
|
|
|
|
def challenge(self, env, location, path="secret.txt"):
|
|
r = env.curl_get(self.url(env, location, path))
|
|
assert r.response["status"] == 401
|
|
return dc.DigestChallenge.parse(r.response["header"]["www-authenticate"])
|
|
|
|
def auth(self, env, location, path, challenge, nc="00000001"):
|
|
return dc.build_authorization(
|
|
AAATestEnv.DIGEST_USER, challenge, AAATestEnv.DIGEST_PASSWORD,
|
|
method="GET", uri=self.uri(location, path), nc=nc,
|
|
cnonce="authinfo-cnonce")
|
|
|
|
def get(self, env, location, path, challenge, nc="00000001"):
|
|
return env.curl_get(self.url(env, location, path), options=[
|
|
"-H", f"Authorization: {self.auth(env, location, path, challenge, nc)}"])
|
|
|
|
def test_digest_110_error_response_carries_authentication_info(self, env):
|
|
# A 404 for an authenticated request still confirms the response to
|
|
# the client: Authentication-Info with a valid rspauth.
|
|
location = "default"
|
|
challenge = self.challenge(env, location)
|
|
r = self.get(env, location, "no-such-file.txt", challenge)
|
|
assert r.response["status"] == 404
|
|
assert "authentication-info" in r.response["header"], \
|
|
"the error response dropped Authentication-Info"
|
|
ai = dc.parse_params(r.response["header"]["authentication-info"])
|
|
expect = dc.rspauth_digest(
|
|
dc.ha1(AAATestEnv.DIGEST_USER, AAATestEnv.REALM,
|
|
AAATestEnv.DIGEST_PASSWORD),
|
|
challenge.nonce, "00000001", "authinfo-cnonce", "auth",
|
|
self.uri(location, "no-such-file.txt"))
|
|
assert ai.get("rspauth") == expect, "rspauth wrong on the error response"
|
|
|
|
def test_digest_111_onetime_client_continues_after_an_error(self, env):
|
|
# Under one-time nonces the error must still hand back a nextnonce,
|
|
# or the client's next request is stale-challenged. Prove the client
|
|
# can carry straight on to a real request with what the 404 gave it.
|
|
location = "onetime"
|
|
challenge = self.challenge(env, location)
|
|
r = self.get(env, location, "no-such-file.txt", challenge)
|
|
assert r.response["status"] == 404
|
|
assert "authentication-info" in r.response["header"], \
|
|
"the one-time-nonce error response dropped Authentication-Info"
|
|
ai = dc.parse_params(r.response["header"]["authentication-info"])
|
|
assert "nextnonce" in ai, "no nextnonce to continue with after the error"
|
|
|
|
challenge.nonce = ai["nextnonce"]
|
|
ok = self.get(env, location, "secret.txt", challenge)
|
|
assert ok.response["status"] == 200, \
|
|
"the nextnonce from the error response was not usable"
|
|
|
|
def test_digest_112_challenge_has_no_authentication_info(self, env):
|
|
# When the error is itself a 401, the challenge stands alone: the
|
|
# client is not handed a nextnonce it could not use beside a fresh
|
|
# nonce. A wrong password reaches note_digest_auth_failure.
|
|
location = "onetime"
|
|
challenge = self.challenge(env, location)
|
|
bad = dc.build_authorization(
|
|
AAATestEnv.DIGEST_USER, challenge, "wrong-password",
|
|
method="GET", uri=self.uri(location, "secret.txt"),
|
|
cnonce="authinfo-cnonce")
|
|
r = env.curl_get(self.url(env, location, "secret.txt"),
|
|
options=["-H", f"Authorization: {bad}"])
|
|
env.httpd_error_log.ignore_recent(lognos=["AH01794"]) # password mismatch
|
|
assert r.response["status"] == 401
|
|
assert "authentication-info" not in r.response["header"], \
|
|
"a 401 challenge carried an Authentication-Info header"
|