LWP small fix required
Ivan Ladygin <[email protected]> Tue, 31 Jan 2017 10:52:58 +0300
| Newsgroups | gmane.comp.lang.perl.modules.lwp |
|---|---|
| Message-ID | <[email protected]> |
--------------37D70F4A1E9883E2C79B3D31
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
LWP Digest authorisation small bag, in case response contents 2 (or
more) fields WWW-Authentificate like this:
/Server: Apache-Coyote/1.1//
//Vary: Accept-Encoding//
//WWW-Authenticate: Digest realm="1Realm", qop="auth",
nonce="1485848015167:56976:56060fb913a12670c39d700055b7679d",
opaque="ca05e8a9b744eb6c91c624ef9c61fb97"//
//WWW-Authenticate: Digest realm="2Realm", qop="auth",
nonce="1485848015167:96504:777475a2092ab30b6a23349cdb139e75",
opaque="ca05e8a9b744eb6c91c624ef9c61fb97"//
//Content-Length: 92//
//Content-Type: text/xml;charset=UTF-8/
in this case LWP will use first realm only, so if user provide "2realm"
credentials this will be ignored by LWP. (bad authorization attempt)
My fix(add to LWP::UserAgent after line 393 in "sub request", before
"return $class->authenticate"):
/ unless
($self->{basic_authentication}{$request->uri_canonical->host_port}{$$challenge{realm}}){//
// $response->header("Client-Warning" =>"Undefined authentication
realm '$$challenge{realm}'");//
// next CHALLENGE;//
// }/
this fix fill compare user defined credentials with server first
response and use it only if realm name is same.
Ivan Ladygin
--------------37D70F4A1E9883E2C79B3D31
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>LWP Digest authorisation small bag, in case response contents 2
(or more) fields WWW-Authentificate like this:</p>
<p><i>Server: Apache-Coyote/1.1</i><i><br>
</i><i>Vary: Accept-Encoding</i><i><br>
</i><i>WWW-Authenticate: Digest realm="1Realm", qop="auth",
nonce="1485848015167:56976:56060fb913a12670c39d700055b7679d",
opaque="ca05e8a9b744eb6c91c624ef9c61fb97"</i><i><br>
</i><i>WWW-Authenticate: Digest realm="2Realm", qop="auth",
nonce="1485848015167:96504:777475a2092ab30b6a23349cdb139e75",
opaque="ca05e8a9b744eb6c91c624ef9c61fb97"</i><i><br>
</i><i>Content-Length: 92</i><i><br>
</i><i>Content-Type: text/xml;charset=UTF-8</i><br>
</p>
<p>in this case LWP will use first realm only, so if user provide
"2realm" credentials this will be ignored by LWP. (bad
authorization attempt)</p>
<p>My fix(add to LWP::UserAgent after line 393 in "sub request",
before "return $class->authenticate"):</p>
<p><i> unless
($self->{basic_authentication}{$request->uri_canonical->host_port}{$$challenge{realm}}){</i><i><br>
</i><i> $response->header("Client-Warning"
=>"Undefined authentication realm '$$challenge{realm}'");</i><i><br>
</i><i> next CHALLENGE;</i><i><br>
</i><i> }</i><br>
</p>
<p>this fix fill compare user defined credentials with server first
response and use it only if realm name is same.</p>
<p>Ivan Ladygin<br>
</p>
</body>
</html>
--------------37D70F4A1E9883E2C79B3D31--