FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Implement HTTP Digest Access Authentication by hyperxpro · Pull Request #2089 · AsyncHttpClient/async-http-client · GitHub

/ async-http-client Public

Implement HTTP Digest Access Authentication - #2089

Closed
hyperxpro wants to merge 1 commit into
mainfrom
digest-auth
ConversationCommits (1)ChecksFiles changed
Closed

Implement HTTP Digest Access Authentication#2089
hyperxpro wants to merge 1 commit into
mainfrom
digest-auth

Conversation

hyperxpro commented May 10, 2025

Copy link
Copy Markdown
Member

RFC 7616 - HTTP Digest Access Authentication

Closes #2068

hyperxpro mentioned this pull request May 10, 2025
Closed
pratt4 reviewed May 12, 2025
View reviewed changes

pratt4 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Please review the comments and let me know If the observations make sense...

If you'd like, I can pick up these fixes and push the changes (along with tests) on top of this PR to help wrap it up faster.
Let me know... happy to help!!!

Comment thread client/src/main/java/org/asynchttpclient/Realm.java
private void newCnonce(MessageDigest md) {
byte[] b = new byte[8];
ThreadLocalRandom.current().nextBytes(b);
b = md.digest(b);

pratt4 May 12, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

MD5 =16 bytes; SHA-256 = 32 bytes;
rfc7616 doesn’t forbid long nonces... but wont the headers that big can be unwieldy, especially if you’re proxying or logging??

mistressxalexis Feb 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

MD5 =16 bytes; SHA-256 = 32 bytes;

rfc7616 doesn’t forbid long nonces... but wont the headers that big can be unwieldy, especially if you’re proxying or logging??

!

pratt4 reviewed May 12, 2025
View reviewed changes
Comment thread client/src/main/java/org/asynchttpclient/Realm.java
return MessageDigestUtils.pooledMd5MessageDigest();
} else if ("SHA-256".equalsIgnoreCase(algorithm) || "SHA-256-sess".equalsIgnoreCase(algorithm)) {
return MessageDigestUtils.pooledSha256MessageDigest();
} else if ("SHA-512-256".equalsIgnoreCase(algorithm) || "SHA-512-256-sess".equalsIgnoreCase(algorithm)) {

pratt4 May 12, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

will it handle "SHA-512/256" ??
some server might send with / 's
and even "SHA-512/256" is mentioned in standard names docs... https://docs.oracle.com/en/java/javase/12/docs/specs/security/standard-names.html

Comment thread client/src/main/java/org/asynchttpclient/Realm.java

private static byte[] md5FromRecycledStringBuilder(StringBuilder sb, MessageDigest md) {
private static byte[] digestFromRecycledStringBuilder(StringBuilder sb, MessageDigest md) {
md.update(StringUtils.charSequence2ByteBuffer(sb, ISO_8859_1));

pratt4 May 12, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

can utf-8 be implemented?

Comment thread client/src/main/java/org/asynchttpclient/Realm.java
return md.digest();
}

private static MessageDigest getDigestInstance(String algorithm) {

pratt4 May 12, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

if the server sends multiple algos (eg: md5, sha256..eg)
then public Builder parseWWWAuthenticateHeader(String headerLine) --- can pick the first algo (here m5 can be chosen even if sha256 is present )

it should choose the algo based on strength right??

pratt4 mentioned this pull request Jun 12, 2025
Merged
hyperxpro added a commit that referenced this pull request Sep 23, 2025
Digest auth new (#2098)
a5763a6 
This is build on top of
#2089

and still some changes are required around new testcases and failing
testcases

closes #2068

---------

Co-authored-by: Aayush Atharva <aayush@shieldblaze.com>
hyperxpro added a commit that referenced this pull request Mar 15, 2026
Digest auth new (#2098)
05c437e 
This is build on top of
#2089

and still some changes are required around new testcases and failing
testcases

closes #2068

---------

Co-authored-by: Aayush Atharva <aayush@shieldblaze.com>

hyperxpro commented Mar 15, 2026

Copy link
Copy Markdown
Member Author

Superseded by #2148

hyperxpro closed this Mar 15, 2026
hyperxpro deleted the digest-auth branch March 15, 2026 11:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

2 more reviewers
pratt4 pratt4 left review comments
mistressxalexis mistressxalexis left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

any plan for RFC7616?

3 participants

Back | FazBrowse Home | New Git URL