search

barnacs / compy

HTTP/HTTPS compression proxy
ISC License
204 stars 34 forks source link

Fix RFC 7235 violation #45

Closed ggramaize closed 5 years ago

ggramaize commented 5 years ago

Hi,

When an unauthorized/unauthenticated user attempts to send a request on a compy instance requiring authentication, compy sends back the WWW-Authenticate header field, instead of the expected Proxy-Authentication header field in the HTTP 407 Proxy Authentication Required reply.

This behaviour violates RFC 7235, which states in section 3.2:

The proxy MUST send a Proxy-Authenticate header field (Section 4.3) containing a challenge applicable to that proxy for the target resource.

This is a high priority fix IMHO: a standards-compliant browser doesn't send back the authentication prompt, and lands on a blank page with the offending version.

Kind regards

gaul commented 5 years ago

@ggramaize Thank you for your contribution! Did you experience problems with a specific browser?

gaul commented 5 years ago

Fixed Travis failure in 807a3c31c07eaa2e16dd77ec071dd98e14a88fc7.

ggramaize commented 5 years ago

@gaul With Firefox 63 (Nightly), when I set the proxy, the browser returned a blank page without asking a proxy password. Correcting this using this solved the issue. I've also had issues while using curl, wget, and lynx.

Moreover, I've had issues with authentication on HTTPS websites, because when proxying a connection, the proxy shall authenticate the CONNECT, but not the inner HTTP session (which is theoretically not MITMed, thus untouched ;) ).

To solve this, in proxy/proxy.go, after checking that p.user isn't unset (on line 114), I also checked that the request TLS context equals nil to trigger the authentication test. That solution is, however, flawed, because I expect it would bypass authentication if you set TLS on the client side (with -cert and -key options), but I've not tested that hypothesis right now.