[mod_auth] do not use quoted-string for algorithm

https://www.rfc-editor.org/rfc/rfc7616.txt
3.3.  The WWW-Authenticate Response Header Field
...
   For historical reasons, a sender MUST only generate the quoted string
   syntax values for the following parameters: realm, domain, nonce,
   opaque, and qop.

   For historical reasons, a sender MUST NOT generate the quoted string
   syntax values for the following parameters: stale and algorithm.
personal/stbuehler/ci-build
Glenn Strauss 4 years ago
parent 019efb0ed8
commit 1799e4c3eb

@ -868,9 +868,9 @@ static void mod_auth_digest_www_authenticate(buffer *b, time_t cur_ts, const str
}
buffer_append_string_len(b, CONST_STR_LEN("Digest realm=\""));
buffer_append_string_buffer(b, require->realm);
buffer_append_string_len(b, CONST_STR_LEN("\", charset=\"UTF-8\", algorithm=\""));
buffer_append_string_len(b, CONST_STR_LEN("\", charset=\"UTF-8\", algorithm="));
buffer_append_string_len(b, algoname[i], algolen[i]);
buffer_append_string_len(b, CONST_STR_LEN("\", nonce=\""));
buffer_append_string_len(b, CONST_STR_LEN(", nonce=\""));
buffer_append_uint_hex(b, (uintmax_t)cur_ts);
buffer_append_string_len(b, CONST_STR_LEN(":"));
(append_nonce[i])(b, cur_ts, rnd);

Loading…
Cancel
Save