diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2019-11-22 23:36:38 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-11-22 23:36:38 (GMT) |
| commit | b9e5547f5814962964c4a5bd5cd36a2af8fbf974 (patch) | |
| tree | 56af8e93310eb759866fbd9799288de75d12df54 /Misc | |
| parent | ca5fafc2bbda9373c9ab12b76d17614585cffc23 (diff) | |
| download | cpython-b9e5547f5814962964c4a5bd5cd36a2af8fbf974.zip cpython-b9e5547f5814962964c4a5bd5cd36a2af8fbf974.tar.gz cpython-b9e5547f5814962964c4a5bd5cd36a2af8fbf974.tar.bz2 | |
bpo-38686: fix HTTP Digest handling in request.py (GH-17045)
* fix HTTP Digest handling in request.py
There is a bug triggered when server replies to a request with `WWW-Authenticate: Digest` where `qop="auth,auth-int"` rather than mere `qop="auth"`. Having both `auth` and `auth-int` is legitimate according to the `qop-options` rule in §3.2.1 of [[https://www.ietf.org/rfc/rfc2617.txt|RFC 2617]]:
> qop-options = "qop" "=" <"> 1GH-qop-value <">
> qop-value = "auth" | "auth-int" | token
> **qop-options**: [...] If present, it is a quoted string **of one or more** tokens indicating the "quality of protection" values supported by the server. The value `"auth"` indicates authentication; the value `"auth-int"` indicates authentication with integrity protection
This is description confirmed by the definition of the [//n//]`GH-`[//m//]//rule// extended-BNF pattern defined in §2.1 of [[https://www.ietf.org/rfc/rfc2616.txt|RFC 2616]] as 'a comma-separated list of //rule// with at least //n// and at most //m// items'.
When this reply is parsed by `get_authorization`, request.py only tests for identity with `'auth'`, failing to recognize it as one of the supported modes the server announced, and claims that `"qop 'auth,auth-int' is not supported"`.
* 📜🤖 Added by blurb_it.
* bpo-38686 review fix: remember why.
* fix trailing space in Lib/urllib/request.py
Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com>
(cherry picked from commit 14a89c47983f2fb9e7fdf33c769e622eefd3a14a)
Co-authored-by: PypeBros <PypeBros@users.noreply.github.com>
Diffstat (limited to 'Misc')
| -rw-r--r-- | Misc/NEWS.d/next/Library/2019-11-06-15-26-15.bpo-38686.HNFBce.rst | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Misc/NEWS.d/next/Library/2019-11-06-15-26-15.bpo-38686.HNFBce.rst b/Misc/NEWS.d/next/Library/2019-11-06-15-26-15.bpo-38686.HNFBce.rst new file mode 100644 index 0000000..7a419ff --- /dev/null +++ b/Misc/NEWS.d/next/Library/2019-11-06-15-26-15.bpo-38686.HNFBce.rst @@ -0,0 +1 @@ +Added support for multiple ``qop`` values in :class:`urllib.request.AbstractDigestAuthHandler`.
\ No newline at end of file |