2009/3/10 cool goose <[email protected]>:
> If I understand correctly, UAC can resend the REGISTER-2 (with Authorization
> header) with out recalculating the digest response again. Provided it has
> the same nonce value and belongs to the same registration session.
>
> Is this correct?
When a server (registrar in this case) creates a nonce there is not a
fixed rule about for how long this nonce is valid. Some UA's expire
the nonce after being used once, others after two usages, others after
some time...
Also, when credentials are correct (Digest response is correct for the
present nonce and user) if the UA has before expired that nonce it can
reply a 401 adding "stale=true". Please read the following section in
RFC 2617:
stale
A flag, indicating that the previous request from the client was
rejected because the nonce value was stale. If stale is TRUE
(case-insensitive), the client may wish to simply retry the request
with a new encrypted response, without reprompting the user for a
new username and password. The server should only set stale to TRUE
if it receives a request for which the nonce is invalid but with a
valid digest for that nonce (indicating that the client knows the
correct username/password). If stale is FALSE, or anything other
than TRUE, or the stale directive is not present, the username
and/or password are invalid, and new values must be obtained.
Regards.
--
Iñaki Baz Castillo
<[email protected]>
_______________________________________________
Sip-implementors mailing list
[email protected]
https://lists.cs.columbia.edu/cucslists/listinfo/sip-implementors
