search

sigoden / dufs

A file server that supports static serving, uploading, searching, accessing control, webdav...
Other
6.44k stars 318 forks source link

webdav: Support empty user password verification #482

Closed oorrnae closed 2 hours ago

oorrnae commented 2 hours ago

When using the rustydav library to send a null username and password.

PROPFIND / HTTP/1.1\r\nauthorization: Basic Og==\r\ndepth: 1\r\ncontent-length: 0\r\naccept: */*\r\nhost: 192.168.123.200:5000\r\n\r\n<?xml version="1.0" encoding="utf-8" ?>\n            <D:propfind xmlns:D="DAV:">\n                <D:allprop/>\n            </D:propfind>\n

due to "authorization: Basic Og==", which results in an authentication failure return of 2024-11-15T15:40:55+08:00 INFO - 127.0.0.1 “PROPFIND /” 401

When manually removing the "authorization:" construct http retransmission everything works fine!

sigoden commented 2 hours ago

Empty authentication is not a good practice. We will not support it.