arturobernalg opened a new pull request, #872: URL: https://github.com/apache/httpcomponents-client/pull/872
The client recomputes `rspauth` from the session state of the last request and compares it to the value returned by the server in constant time, so mutual authentication no longer depends solely on the request being accepted. For `qop=auth` the `cnonce` and `nc` echoed by the server are required and must match the values used for that request, and an Authentication-Info that states `qop=auth` must carry `rspauth`, `cnonce` and `nc`. Verification is confined to `qop=auth;` the `rspauth` of `qop=auth-int` hashes the response body, which is not available to the scheme. An Authentication-Info without `rspauth` remains acceptable unless the server states `qop=auth`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
