How can I increase Nonce expiration time

flakey-bit / DotNetDigestAuth

Implementation of Digest Authentication for ASP.NET Core & ASP.NET

MIT License

17 stars 7 forks source link

How can I increase Nonce expiration time #18

Closed hussain1368 closed 2 years ago

hussain1368 commented 2 years ago

How can I increase Nonce expiration time? I tried increasing maxNonceAgeSeconds but no effect was seen

flakey-bit commented 2 years ago

Hi @hussain1368,

Are you using the ASP.NET Core version or the ASP.NET classic (full framework) version?

Are you able to share your configuration (e.g. Startup.cs file)?

I've tested this and it appears to be working as expected for me:

I changed the maxNonceAgeSeconds in the demo app from 60 to 120
I made a GET request to http://localhost:50078/api/values endpoint using Chrome
- I was prompted to authenticate on the first request
- I was able to make subsequent requests for the remaining ~119 seconds
- Once 120 seconds had passed & I made another request, I was prompted to reauthenticate

So on the face of it, it appears to be working as intended. Please provide more info to reproduce your issue.

hussain1368 commented 2 years ago

Thanks for your reply. I am using ASP.NET Core version and I configured maxNonceAgeSeconds in the Startup.cs. When I use postman to call my API, if I turn off the "Yes, disable retrying request" it works fine. but when I turn it on and try to send the Nonce and Realm values manually, it does not work and gives me an unauthorized response. Also, when I send post requests with an android app, if the size of the file is too big it again give me unauthorized response, may be because from one request to next the nonce get's expired and the authentication doesn't work

flakey-bit commented 2 years ago

but when I turn it on and try to send the Nonce and Realm values manually, it does not work and gives me an unauthorized response

What are you trying to achieve by checking the "Yes, disable retrying request" checkbox in Postman?
When you disable retrying of the request in Postman, you will need to populate all of the advanced fields manually each time (Realm, Nonce, Algorithm etc) - can you confirm you've been doing this and describe how you've populated each field? See Postman docs on the subject.

Also, when I send post requests with an android app, if the size of the file is too big it again give me unauthorized response

Sorry, I'm not really able to help with that.

flakey-bit commented 2 years ago

Closing ticket as working as intended and no response from issue author.