restify / clients

HttpClient, StringClient, and JsonClient extracted from restify
MIT License
57 stars 34 forks source link

support content-md5 header generated from different node versions #173

Closed twhiteman closed 6 years ago

twhiteman commented 6 years ago

Node v6 changed crypto hash.update() to default to 'utf8' encoding, prior to that (Node.js v4 and older) it used 'binary' encoding.

This can cause a problem when a Node v6 client talks to a Node v4 server (and vice versa), as the default md5 hash generated between these two node versions will be different, e.g.

$ node-6.9 -e "var crypto = require('crypto'); console.log(crypto.createHash('md5').update('¥').digest('base64'));"
B2JeFC5KxZYd5XRyZXqIwQ==
$ node-4.8 -e "var crypto = require('crypto'); console.log(crypto.createHash('md5').update('¥').digest('base64'));"
qzr4Vm3dINfvybMUq+kHVQ==

We at Joyent have hit this issue a few times in different components (and yes, we do have systems running with older Node versions - and ones that won't likely change anytime soon).

You can see current restify clients md5 hash handling here doesn't specify an encoding: https://github.com/restify/clients/blob/a3acb608284bd4b804d4e5ab5982118f151294f0/lib/StringClient.js#L237

To resolve this issue, I think restify clients could be made to support both md5 hash styles ('binary' and 'utf8'). It can do this by generating both hash encoding types and then comparing that at least one of these hashes matches the content-md5 header.

trentm commented 6 years ago

^^ commit 49a9137 was the backport to the "1.x" branch.

restify-clients@1.6.0 and restify-clients@2.5.0 have been published

$ npm info restify-clients dist-tags
{ latest: '2.5.0', 'latest-1': '1.6.0' }