search

go-resty / resty

Simple HTTP and REST client library for Go
MIT License
9.68k stars 681 forks source link

Fix digest auth #789

Closed phw closed 3 months ago

phw commented 3 months ago

This re-implements parsing the digest challenge to fix authentication against servers returning multiple values for qop.

Take this example from https://httpwg.org/specs/rfc7616.html:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Digest
    realm="http-auth@example.org",
    qop="auth, auth-int",
    algorithm=SHA-256,
    nonce="7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v",
    opaque="FQhe/qaU925kfnzjCev0ciny7QMkPqMAFRtzCUYo5tdS"

Here qop is set to qop="auth, auth-int". Because the previous parser split the entire list by comma to obtain the key value pairs this gets separated into qop="auth and auth-int", which eventually failes to parse.

The new parser goes over the challenge rune by rune and does not split when inside a quotation.

Also some servers will respond with qop="auth,auth-int" (no space after the comma). Hence also adjust validateQop to handle this.