View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0004644libmicrohttpddigest authentication (HTTP)public2016-09-06 11:332016-10-17 17:21
Reporter0xda7aba5e Assigned ToChristian Grothoff Due Date
PrioritylowSeverityfeatureReproducibilityN/A
Status closedResolutionwon't fix 
Product Version0.9.51 
Target Version0.9.51Fixed in Version0.9.51 
Summary0004644: The calculation of nonce-timeout should refer to the last valid usage of a nonce
DescriptionIn file "src/microhttpd/digestauth.c" the function "MHD_digest_auth_check" only compares the current time with the timestamp attachted to the nonce and timeout.

I guess the timeout should refer to the last valid usage of a nonce.

eg timeout is 30 sec:
t=0 : nonce created
t=1 : request with nc=1 -> auth success
t=20: request with nc=2 -> auth success
t=31: request with nc=3 -> auth fail due to timeout

The last request (nc=3) should respond with auth success until
"last valid usage + timeout" is reached.
20+30-1 -> auth success
20+30 -> auth success
20+30+1 -> auth fail - timeout




TagsNo tags attached.

Activities

Christian Grothoff

2016-09-06 21:16

manager   ~0011094

I've re-read RFC 2617 and I do not see this requirement at all. In fact, RFC 2617 doesn't specify how timeouts are to be implemented, it just suggest that they should be. It would also be expensive to do what you suggest, as right now we encode the time value in the nonce's string specifically so we do NOT have to store it on the server side. This doesn't harm security (as it is part of what will be hashed), and keeping storage cost down on the server side is important.

If you are concerned about many authentication failures, you should IMO just use a larger timeout, that will be better than us changing the entire scheme to additionally track the last use of a nonce.

Issue History

Date ModifiedUsernameFieldChange
2016-09-06 11:330xda7aba5eNew Issue
2016-09-06 21:16Christian GrothoffNote Added: 0011094
2016-09-06 21:16Christian GrothoffAssigned To => Christian Grothoff
2016-09-06 21:16Christian GrothoffPrioritynormal => low
2016-09-06 21:16Christian GrothoffSeverityminor => feature
2016-09-06 21:16Christian GrothoffStatusnew => feedback
2016-09-06 21:16Christian GrothoffProduct Version => 0.9.51
2016-10-08 23:52Christian GrothoffStatusfeedback => resolved
2016-10-08 23:52Christian GrothoffFixed in Version => 0.9.51
2016-10-08 23:52Christian GrothoffResolutionopen => won't fix
2016-10-08 23:52Christian GrothoffTarget Version => 0.9.51
2016-10-17 17:21Christian GrothoffStatusresolved => closed