Skip to content

Commit 6247297

Browse files
AdrienCastexAdrienCastex
committed
Fixed the 'HTTPDigestAuthentication' class of the v1 and v2 to work with the level 0 of the digest authentication
1 parent 7d2cab0 commit 6247297

File tree

4 files changed

+47
-41
lines changed

4 files changed

+47
-41
lines changed

‎lib/user/authentication/HTTPDigestAuthentication.js

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -31,14 +31,10 @@ var HTTPDigestAuthentication = (function () {
3131
});
3232
};
3333
var authHeader = arg.findHeader('Authorization');
34-
if (!authHeader) {
35-
onError(Errors_1.Errors.MissingAuthorisationHeader);
36-
return;
37-
}
38-
if (!/^Digest (\s*[a-zA-Z]+\s*=\s*(("(\\"|[^"])+")|([^,\s]+))\s*(,|$))+$/.test(authHeader)) {
39-
onError(Errors_1.Errors.WrongHeaderFormat);
40-
return;
41-
}
34+
if (!authHeader)
35+
return onError(Errors_1.Errors.MissingAuthorisationHeader);
36+
if (!/^Digest (\s*[a-zA-Z]+\s*=\s*(("(\\"|[^"])+")|([^,\s]+))?\s*(,|$))+$/.test(authHeader))
37+
return onError(Errors_1.Errors.WrongHeaderFormat);
4238
authHeader = authHeader.substring(authHeader.indexOf(' ') + 1); // remove the authentication type from the string
4339
var authProps = {};
4440
var rex = /([a-zA-Z]+)\s*=\s*(?:(?:"((?:\\"|[^"])+)")|([^,\s]+))/g;
@@ -47,18 +43,26 @@ var HTTPDigestAuthentication = (function () {
4743
authProps[match[1]] = match[3] ? match[3] : match[2];
4844
match = rex.exec(authHeader);
4945
}
50-
if (!(authProps.username && authProps.nonce && authProps.nc && authProps.cnonce && authProps.qop && authProps.response)) {
51-
onError(Errors_1.Errors.AuenticationPropertyMissing);
52-
return;
53-
}
46+
if (!(authProps.username && authProps.nonce && authProps.response))
47+
return onError(Errors_1.Errors.AuenticationPropertyMissing);
48+
if (!authProps.algorithm)
49+
authProps.algorithm = 'MD5';
5450
userManager.getUserByName(authProps.username, function (e, user) {
55-
if (e) {
56-
onError(e);
57-
return;
58-
}
51+
if (e)
52+
return onError(e);
5953
var ha1 = md5(authProps.username + ':' + _this.realm + ':' + (user.password ? user.password : ''));
60-
var ha2 = md5(arg.request.method.toString().toUpperCase() + ':' + arg.uri);
61-
var result = md5(ha1 + ':' + authProps.nonce + ':' + authProps.nc + ':' + authProps.cnonce + ':' + authProps.qop + ':' + ha2);
54+
if (authProps.algorithm === 'MD5-sess')
55+
ha1 = md5(ha1 + ':' + authProps.nonce + ':' + authProps.cnonce);
56+
var ha2;
57+
if (authProps.qop === 'auth-int')
58+
return onError(Errors_1.Errors.WrongHeaderFormat); // ha2 = md5(ctx.request.method.toString().toUpperCase() + ':' + ctx.requested.uri + ':' + md5(...));
59+
else
60+
ha2 = md5(arg.request.method.toString().toUpperCase() + ':' + arg.uri);
61+
var result;
62+
if (authProps.qop === 'auth-int' || authProps.qop === 'auth')
63+
result = md5(ha1 + ':' + authProps.nonce + ':' + authProps.nc + ':' + authProps.cnonce + ':' + authProps.qop + ':' + ha2);
64+
else
65+
result = md5(ha1 + ':' + authProps.nonce + ':' + ha2);
6266
if (result.toLowerCase() === authProps.response.toLowerCase())
6367
callback(Errors_1.Errors.None, user);
6468
else

‎lib/user/v2/authentication/HTTPDigestAuthentication.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ var HTTPDigestAuthentication = (function () {
4444
authProps[match[1]] = match[3] ? match[3] : match[2];
4545
match = rex.exec(authHeader);
4646
}
47-
if (!(authProps.username && authProps.nonce && authProps.nc && authProps.cnonce && authProps.response))
47+
if (!(authProps.username && authProps.nonce && authProps.response))
4848
return onError(Errors_1.Errors.AuenticationPropertyMissing);
4949
if (!authProps.algorithm)
5050
authProps.algorithm = 'MD5';

‎src/user/authentication/HTTPDigestAuthentication.ts

Lines changed: 23 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,9 @@ export class HTTPDigestAuthentication implements HTTPAuthentication
4242

4343
let authHeader = arg.findHeader('Authorization')
4444
if(!authHeader)
45-
{
46-
onError(Errors.MissingAuthorisationHeader)
47-
return;
48-
}
49-
if(!/^Digest (\s*[a-zA-Z]+\s*=\s*(("(\\"|[^"])+")|([^,\s]+))\s*(,|$))+$/.test(authHeader))
50-
{
51-
onError(Errors.WrongHeaderFormat);
52-
return;
53-
}
45+
return onError(Errors.MissingAuthorisationHeader);
46+
if(!/^Digest (\s*[a-zA-Z]+\s*=\s*(("(\\"|[^"])+")|([^,\s]+))?\s*(,|$))+$/.test(authHeader))
47+
return onError(Errors.WrongHeaderFormat);
5448

5549
authHeader = authHeader.substring(authHeader.indexOf(' ') + 1); // remove the authentication type from the string
5650

@@ -64,22 +58,30 @@ export class HTTPDigestAuthentication implements HTTPAuthentication
6458
match = rex.exec(authHeader);
6559
}
6660

67-
if(!(authProps.username && authProps.nonce && authProps.nc && authProps.cnonce && authProps.qop && authProps.response))
68-
{
69-
onError(Errors.AuenticationPropertyMissing);
70-
return;
71-
}
61+
if(!(authProps.username && authProps.nonce && authProps.response))
62+
return onError(Errors.AuenticationPropertyMissing);
63+
if(!authProps.algorithm)
64+
authProps.algorithm = 'MD5';
7265

7366
userManager.getUserByName(authProps.username, (e, user) => {
7467
if(e)
75-
{
76-
onError(e);
77-
return;
78-
}
68+
return onError(e);
7969

80-
const ha1 = md5(authProps.username + ':' + this.realm + ':' + (user.password ? user.password : ''));
81-
const ha2 = md5(arg.request.method.toString().toUpperCase() + ':' + arg.uri);
82-
const result = md5(ha1 + ':' + authProps.nonce + ':' + authProps.nc + ':' + authProps.cnonce + ':' + authProps.qop + ':' + ha2);
70+
let ha1 = md5(authProps.username + ':' + this.realm + ':' + (user.password ? user.password : ''));
71+
if(authProps.algorithm === 'MD5-sess')
72+
ha1 = md5(ha1 + ':' + authProps.nonce + ':' + authProps.cnonce);
73+
74+
let ha2;
75+
if(authProps.qop === 'auth-int')
76+
return onError(Errors.WrongHeaderFormat); // ha2 = md5(ctx.request.method.toString().toUpperCase() + ':' + ctx.requested.uri + ':' + md5(...));
77+
else
78+
ha2 = md5(arg.request.method.toString().toUpperCase() + ':' + arg.uri);
79+
80+
let result;
81+
if(authProps.qop === 'auth-int' || authProps.qop === 'auth')
82+
result = md5(ha1 + ':' + authProps.nonce + ':' + authProps.nc + ':' + authProps.cnonce + ':' + authProps.qop + ':' + ha2);
83+
else
84+
result = md5(ha1 + ':' + authProps.nonce + ':' + ha2);
8385

8486
if(result.toLowerCase() === authProps.response.toLowerCase())
8587
callback(Errors.None, user);

‎src/user/v2/authentication/HTTPDigestAuthentication.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ export class HTTPDigestAuthentication implements HTTPAuthentication
5858
match = rex.exec(authHeader);
5959
}
6060

61-
if(!(authProps.username && authProps.nonce && authProps.nc && authProps.cnonce && authProps.response))
61+
if(!(authProps.username && authProps.nonce && authProps.response))
6262
return onError(Errors.AuenticationPropertyMissing);
6363
if(!authProps.algorithm)
6464
authProps.algorithm = 'MD5';

0 commit comments

Comments
 (0)