bugGNU Wget - Bugs: bug #20299, Basic authentication sent in all...

 
 

bug #20299: Basic authentication sent in all cases, before challenge is issued

Submitted by:  Micah Cowan <micahcowan>
Submitted on:  Sat 30 Jun 2007 06:59:27 AM UTC  
 
Category: NoneSeverity: 6 - Security
Priority: 5 - NormalStatus: Fixed In Repository
Privacy: PublicAssigned to: Micah Cowan <micahcowan>
Originator Name: Open/Closed: Closed
Release: 1.10.2Operating System: None
Reproducibility: Every TimeFixed Release: 1.11
Planned Release: 1.11Regression: No
Work Required: NonePatch Included: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 28 Jul 2007 03:17:18 AM UTC, comment #3:

Um, yeah, that "details" link obviously was to the main archive site, and not the actual message. Here it is:

http://article.gmane.org/gmane.comp.web.wget.general/6861

The more complete, proper, RFC-compliant fix is bug 20607.

Micah Cowan <micahcowan>In charge of this item.
Sat 28 Jul 2007 03:01:23 AM UTC, comment #2:

Probably won't have time to do more thorough automated tests (though I did implement a small one). Want to document some of the things that should be tested, while it's still fairly fresh in my mind:

- Verify that wget always waits for a challenge before issuing creds, until it has authenticated itself with a host.

- Verify that wget automatically issues creds with which it has already done Basic auth.

- Verify that wget will acknowledge Digest challenges properly, on hosts that had previously been Basic auth'd.

- Verify that wget will properly auth with specific user:pass@ URIs, on hosts that had already been auth'd with global user/pass settings, and then return to authenticating with the global settings on further URIs.

- Verify that wget will not carry user/pass settings across hosts (until they also challenge).

Micah Cowan <micahcowan>In charge of this item.
Sat 28 Jul 2007 02:32:38 AM UTC, comment #1:

Details of the changes I'd like to make in wget's authentication, and the stop-gap fixes I'm fixing for this bug branch:

http://news.gmane.org/gmane.comp.web.wget.general

Here's the bit on what is covered in this bugbranch:

. user:pass@ will still affect just one URI; however, it will wait for a
challenge before authenticating.

. --user and --password will wait for a challenge before authentication.
If the challenge mechanism is Basic, it will assume the protection space
is the entire host (which will be tracked with a simple hash table).
Digest and NTLM will be forgotten after each authentication, just as
happens currently.

Micah Cowan <micahcowan>In charge of this item.
Sat 30 Jun 2007 06:59:27 AM UTC, original submission:

Regardless of what authentication mechanism is employed by the server--or even in the case when the server doesn't require authentication--if the user specifies a username and password, it will be sent using Basic authentication, sending the password in encoded but unencrypted form.

Wget should instead wait until the server issues a challenge, so that it knows which mechanism to use.

However, since some are concerned about the loss in efficiency this will bring, perhaps there can be an option to force wget to use the current behavior. I'm not completely convinced that this is a good idea...

Micah Cowan <micahcowan>In charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by micahcowan (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 30 Jul 2007 01:15:01 AM UTCmicahcowanStatusIn Progress=>Fixed In Repository
      Open/ClosedOpen=>Closed
      Fixed ReleaseNone=>1.11
    Fri 13 Jul 2007 05:44:45 AM UTCmicahcowanStatusConfirmed=>In Progress
    Tue 03 Jul 2007 06:04:23 AM UTCmicahcowanRegressionNone=>No

    Back to the top


    Powered by Savane 3.1-cleanup1