arturobernalg opened a new pull request, #1109: URL: https://github.com/apache/tomcat/pull/1109
`Authorization.parseAuthorizationDigest` does not follow RFC 9110 in three ways. The authentication scheme is case-insensitive (section 11.1), but "Digest" was matched case-sensitively, so a request with `digest username="a", ...` was rejected and got a 401 response. The parameter names are case-insensitive (section 11.2): the parser looked up the field type with a lower case name but stored the name as received, so `Username="a"` was never found by `DigestAuthenticator`. A recipient must parse and ignore empty list elements (section 5.6.1.2), but `Digest username="a",, realm="r"` was rejected. This change reads the scheme as a token and compares it ignoring case, lower cases the parameter names and skips the empty elements. As a side effect `Digestusername="a"`, which was accepted by accident, is now rejected. TestAuthorizationDigest has four new tests. They fail without the change and pass with it, and the other `TestDigestAuthenticator*` classes and TestBasicAuthParser still pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
