Jetty

HTTP POST content is garbled when using digest authentication

Details

  • Type: Bug Bug
  • Status: Resolved Resolved
  • Priority: Major Major
  • Resolution: Fixed
  • Affects Version/s: 6.1.22
  • Fix Version/s: 6.1.23
  • Component/s: Security and SSL
  • Labels:
    None
  • Testcase included:
    yes
  • Number of attachments :
    3

Description

When using digest authentication, the first few lines of HTTP POST request payload are replaced with partial request headers when the request body is read by the servlet.

  1. File
    jetty-1192-1.diff
    15/Mar/10 7:55 AM
    0.7 kB
    Greg Wilkins
  2. Java Source File
    SecuredPostTest.java
    15/Mar/10 7:51 AM
    12 kB
    Greg Wilkins
  3. GZip Archive
    test-secure-post.tar.gz
    11/Mar/10 6:40 PM
    3 kB
    Michael Gorovoy

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Michael Gorovoy added a comment -

I have just tried the test harness with Jetty 6.1-SNAPSHOT build, and it exhibits the same behavior as 6.1.22 release.

Show
Michael Gorovoy added a comment - I have just tried the test harness with Jetty 6.1-SNAPSHOT build, and it exhibits the same behavior as 6.1.22 release.
Hide
Permalink
Greg Wilkins added a comment -

This is an update of the test harness, that does some more direct testing of digest. It does a HTTP/1.0 and HTTP/1.1 direct tests, which appear to always work.

It also does a HttpClient test with a Buffer instead of a stream. This appears to mostly work, but fails sometimes when run with other tests.

Found one small bug in DigestAuthenticator, which I think might be unrelated.

Will now capture some wire traces to investigate further.

Show
Greg Wilkins added a comment - This is an update of the test harness, that does some more direct testing of digest. It does a HTTP/1.0 and HTTP/1.1 direct tests, which appear to always work. It also does a HttpClient test with a Buffer instead of a stream. This appears to mostly work, but fails sometimes when run with other tests. Found one small bug in DigestAuthenticator, which I think might be unrelated. Will now capture some wire traces to investigate further.
Hide
Permalink
Greg Wilkins added a comment -

this is the fix to digest auth that makes it more tolerant parsing.

Show
Greg Wilkins added a comment - this is the fix to digest auth that makes it more tolerant parsing.
Hide
Permalink
Greg Wilkins added a comment -

There were at least three issues hiding here.
Digest authentication was not well parsing the authorization field.
The HttpConnection could "cache" unconsumed content and make it available to a subsequent request with no content. The HttpClient was not resending the content on a digest retry.

These were mostly fixed in jetty-7, so I have back ported those fixes
and fixed the others.

Show
Greg Wilkins added a comment - There were at least three issues hiding here. Digest authentication was not well parsing the authorization field. The HttpConnection could "cache" unconsumed content and make it available to a subsequent request with no content. The HttpClient was not resending the content on a digest retry. These were mostly fixed in jetty-7, so I have back ported those fixes and fixed the others.

People

  • Assignee:
    Greg Wilkins
    Reporter:
    Michael Gorovoy
Vote (0)
Watch (1)

Dates

  • Created:
    Updated:
    Resolved: