Having heard no response here... I posted on github with a fix - issue #2323:
https://github.com/rails/rails/pull/2323 Arthur On Fri, Jun 10, 2011 at 3:32 PM, Arthur Smith <[email protected]> wrote: > I've done a search of the mailing list and not found anything > informative, but possibly missed something, this is my first comment > on this mailing list. > > From RFC 2617 - http://tools.ietf.org/html/rfc2617 - which specifies > Digest Authentication, the section discussing the "digest-uri' element > states: > > "digest-uri > The URI from Request-URI of the Request-Line; duplicated here > because proxies are allowed to change the Request-Line in > transit." > > and the detailed discussion on calculation of the digest value > specifically says: > > "where "digest-uri-value" is the value of the "uri" directive on the > Authorization header in the request." > > That is, the "digest-uri" provided in the Authorization header is what > should be used in calculating the digest for authentication purposes, > not the request URI - because that string may change between the > client and the ultimate server responding to the request. > > However, it looks like this has been implemented incorrectly in Rails > ActionController::HttpAuthentication for some time - for example from > actionpack-3.0.7/lib/action_controller/metal/http_authentication.rb > line 188: > > uri = credentials[:uri][0,1] == '/' ? request.fullpath : > request.url > > This should be simply: > > uri = credentials[:uri] > > We ran into this bug when switching from a java-Spring-Acegi > authentication handler to Rails HttpAuthentication. It had always > worked perfectly with Acegi. Rails digest authentication worked fine > when connecting directly to the server it was installed on, but when > connecting to a front-end server that rewrites the URL's, Rails digest > authentication always failed. With the above patch, digest > authentication works correctly again. > > If there's a need to verify that the digest-uri matches in some way > the request uri the server should do that separately from the actual > digest authentication piece, which should just match the > specifications of RFC 2617. Agreed? > > -- > You received this message because you are subscribed to the Google Groups > "Ruby on Rails: Core" group. > To post to this group, send email to [email protected]. > To unsubscribe from this group, send email to > [email protected]. > For more options, visit this group at > http://groups.google.com/group/rubyonrails-core?hl=en. > > -- You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/rubyonrails-core?hl=en.
