fkaempfer commented on issue #1183: Proxy Authentication doesn't work when proxy_use_secret=true URL: https://github.com/apache/couchdb/issues/1183#issuecomment-374856324 On first glance, no, I think there are no proxy tests. This is not well documented, I found out about it by looking at the source here: https://github.com/apache/couchdb/blob/master/src/couch/src/couch_httpd_auth.erl#L173 I think the hmac encoding of the username provides only slightly better security, but it is confusing to users. Perhaps the http auth should allow both options at the same time, either the secret directly (#1174), or the encoded username. If an attacker already knows about the secret, it is trivial to generate the tokens, so there is no harm in allowing the secret as a token, if users desire it.
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
