abbot / go-http-auth

Basic and Digest HTTP Authentication for golang http
Apache License 2.0
544 stars 121 forks source link

DigestAuth functions aren't thread-safe (Race conditions) #52

Closed nlacey closed 6 years ago

nlacey commented 6 years ago

go build -race, will add instrumentation to catch race conditions. It caught problem within DigestAuth.clients (map)

I'm attaching a copy of digest.go. I changed the mutex to be a read/write mutex, so you could have finer grain control over it. this copy doesn't cause problems with -race

Also I started to fix golint problems https://github.com/golang/lint. But stopped, because it was getting out of hand. (Sorry for dirtying up the answer) digest.txt

Thanks for your awesome work on the repo!!

digest.txt is really digest.go!

BryceDFisher commented 6 years ago

53

WGH- commented 6 years ago

Not only it's a theoretical problem catched by Go race detector, it actually occasionally leads to crashes.

abbot commented 6 years ago

Fix is now merged.