2009/3/10 cool goose <[email protected]>:
> A user agent that wishes to authenticate itself with an origin
> server--usually, but not necessarily, after receiving a 401
> (Unauthorized)--MAY do so by including an Authorization header field
> with the request.
>
> "
>
> Does this mean that a UAC can originate a REGISTER request with
> Authorization header before it receives 401 Un authorized? If so, what would
> be the contents of such REGISTER request? What would be the value of nonce
> field?
>
> Since the nonce value is provided by UAC or registrar in 401 Un authorized,
> if UAC wishes to authenticate itself before receiving 401, what should it
> use for the nonce value for computing the digest response?
You should understand an important point here: Digest authentication
mechanims doesn't require a request witout credentials followed by the
same request with credentials. It's simpler than that:
When a server/proxy receives a request with credentials (and those are
required to process the request) it inspects these credentials against
the current nonce list generated by this server.
In the simplest case the following would occur:
UA1 UA2
Server
----------- request without credencials
-------------------------------------------->
<-----------------401 (nonce=ABCD)
-------------------------------------------------
--- request with credendials
(nonce=ABCD) ------->
<-------------- 200
------------------------------------------
This is:
- UA1 sends a request with no credentials.
- The server creates a nonce and sends it via 401 to UA1.
- In some way, UA2 discovers that nonce and uses it to generate a
request with credentials.
- It's a recent and still not used nonce so the server accepts it.
By using some extensions as "qop" I think this is not possible since
other factors are computed in the 'response' (not sure anyway).
A good example in which a request is sent *directrly* with credentials
is when sending an ACK or a re-INVITE in a dialog. The server could
accept an already used nonce (in the initial INVITE) in other requests
(until the nonce expires by any reason choosen by the server
implementor).
--
Iñaki Baz Castillo
<[email protected]>
_______________________________________________
Sip-implementors mailing list
[email protected]
https://lists.cs.columbia.edu/cucslists/listinfo/sip-implementors
