diff options
| author | Stephen Balousek <sbalousek@users.noreply.github.com> | 2020-02-29 20:31:58 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-02-29 20:31:58 (GMT) |
| commit | 5e260e0fde211829fcb67060cfd602f4b679f802 (patch) | |
| tree | ca97a14821c44b6dcb7691fe7c4e1d6ca2e5f8d5 /Lib/urllib | |
| parent | eb47fd58ab6483857661aa0822986538a68aa0e5 (diff) | |
| download | cpython-5e260e0fde211829fcb67060cfd602f4b679f802.zip cpython-5e260e0fde211829fcb67060cfd602f4b679f802.tar.gz cpython-5e260e0fde211829fcb67060cfd602f4b679f802.tar.bz2 | |
bpo-39548: Fix handling of 'WWW-Authenticate' header for Digest Auth (GH-18338)
* bpo-39548: Fix handling of 'WWW-Authenticate' header for Digest authentication
- The 'qop' value in the 'WWW-Authenticate' header is optional. The
presence of 'qop' in the header should be checked before its value
is parsed with 'split'.
Signed-off-by: Stephen Balousek <stephen@balousek.net>
* bpo-39548: Fix handling of 'WWW-Authenticate' header for Digest authentication
- Add NEWS item
Signed-off-by: Stephen Balousek <stephen@balousek.net>
* Update Misc/NEWS.d/next/Library/2020-02-06-05-33-52.bpo-39548.DF4FFe.rst
Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com>
Co-authored-by: Brandt Bucher <brandtbucher@gmail.com>
Diffstat (limited to 'Lib/urllib')
| -rw-r--r-- | Lib/urllib/request.py | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/Lib/urllib/request.py b/Lib/urllib/request.py index a6d350a..7fe5053 100644 --- a/Lib/urllib/request.py +++ b/Lib/urllib/request.py @@ -1138,7 +1138,9 @@ class AbstractDigestAuthHandler: req.selector) # NOTE: As per RFC 2617, when server sends "auth,auth-int", the client could use either `auth` # or `auth-int` to the response back. we use `auth` to send the response back. - if 'auth' in qop.split(','): + if qop is None: + respdig = KD(H(A1), "%s:%s" % (nonce, H(A2))) + elif 'auth' in qop.split(','): if nonce == self.last_nonce: self.nonce_count += 1 else: @@ -1148,8 +1150,6 @@ class AbstractDigestAuthHandler: cnonce = self.get_cnonce(nonce) noncebit = "%s:%s:%s:%s:%s" % (nonce, ncvalue, cnonce, 'auth', H(A2)) respdig = KD(H(A1), noncebit) - elif qop is None: - respdig = KD(H(A1), "%s:%s" % (nonce, H(A2))) else: # XXX handle auth-int. raise URLError("qop '%s' is not supported." % qop) |