bugGNU Wget - Bugs: bug #28378, Cookies are not sent when...

 
 

bug #28378: Cookies are not sent when attempting digest authentication

Submitted by:  None
Submitted on:  Tue 22 Dec 2009 06:07:56 PM UTC  
 
Category: Protocol IssueSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: Giuseppe Scrivano <gscrivano>
Originator Name: EmmanuelOriginator Email: -unavailable-
Open/Closed: ClosedRelease: 1.12
Operating System: GNU/LinuxReproducibility: Every Time
Fixed Release: NonePlanned Release: None
Regression: NoWork Required: None
Patch Included: No

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 27 May 2010 10:09:37 AM UTC, comment #1:

Thanks for your report!

I confirm this bug.

It is fixed in the source repository by the commit 2365.

Giuseppe Scrivano <gscrivano>
Project AdministratorIn charge of this item.
Tue 22 Dec 2009 06:07:56 PM UTC, original submission:

Hello, here is an output of wget showing that wget doesn't send cookies when in a digest request/response authentication cycle (sensible information has been removed) :

$ wget -d --http-user="somelogin" --http-password="somepassword" --no-proxy --save-cookies /tmp/cookies --load-cookies /tmp/cookies --keep-session-cookies http://127.0.0.1:5000
Setting --http-user (httpuser) to somelogin
Setting --http-password (httppassword) to somepassword
Setting --proxy (useproxy) to 0
Setting --save-cookies (savecookies) to /tmp/cookies
Setting --load-cookies (loadcookies) to /tmp/cookies
Setting --keep-session-cookies (keepsessioncookies) to 1
DEBUG output created by Wget 1.12 on linux-gnu.

--2009-12-22 19:00:07-- http://127.0.0.1:5000/
Host `127.0.0.1' has not issued a general basic challenge.
Connexion vers 127.0.0.1:5000... connecté.
Created socket 3.
Releasing 0x09655078 (new refcount 0).
Deleting unused 0x09655078.

---request begin---
GET / HTTP/1.0
User-Agent: Wget/1.12 (linux-gnu)
Accept: /
Host: 127.0.0.1:5000
Connection: Keep-Alive

---request end---
requête HTTP transmise, en attente de la réponse... (http request sent, waiting for response)
---response begin---
HTTP/1.0 302 Found
Server: PasteWSGIServer/0.5 Python/2.6.4
Date: Tue, 22 Dec 2009 18:00:07 GMT
Content-Type: text/html; charset=UTF-8
location: http://127.0.0.1:5000/login?url=/
Content-Length: 249

---response end---
302 Found
Emplacement: http://127.0.0.1:5000/login?url=/ [suivant] ( == redirect)
Closed fd 3
--2009-12-22 19:00:07-- http://127.0.0.1:5000/login?url=/
Host `127.0.0.1' has not issued a general basic challenge.
Connexion vers 127.0.0.1:5000... connecté.
Created socket 3.
Releasing 0x09655360 (new refcount 0).
Deleting unused 0x09655360.

---request begin---
GET /login?url=/ HTTP/1.0
User-Agent: Wget/1.12 (linux-gnu)
Accept: /
Host: 127.0.0.1:5000
Connection: Keep-Alive

---request end---
requête HTTP transmise, en attente de la réponse... (http request sent, waiting for response)
---response begin---
HTTP/1.0 401 Unauthorized
Server: PasteWSGIServer/0.5 Python/2.6.4
Date: Tue, 22 Dec 2009 18:00:07 GMT
Content-Type: text/html; charset=utf-8
Pragma: no-cache
Cache-Control: no-cache
WWW-Authenticate: Digest nonce="2cbe6008f5cd08cb874b4d08bb7f8a11", opaque="9884d10bdc33fb591fb4027938bd2ad4", realm="somerealm", qop="auth"
Content-Length: 3598
Set-cookie: session=9f59392f383bcba37a16af2d06d7ee814d6fa885c6be7d99c4132856a9a91235f8f77c71; Path=/

---response end---

/!\ Here a cookie is stored

401 Unauthorized

Stored cookie 127.0.0.1 5000 / <session> <insecure> [expiry none] session 9f59392f383bcba37a16af2d06d7ee814d6fa885c6be7d99c4132856a9a91235f8f77c71
Closed fd 3
Connexion vers 127.0.0.1:5000... connecté.
Created socket 3.
Releasing 0x09655710 (new refcount 0).
Deleting unused 0x09655710.

---request begin---
GET /login?url=/ HTTP/1.0
User-Agent: Wget/1.12 (linux-gnu)
Accept: /
Host: 127.0.0.1:5000
Connection: Keep-Alive
Authorization: Digest username="somelogin", realm="somerealm", nonce="2cbe6008f5cd08cb874b4d08bb7f8a11", uri="/login?url=/", response="9858885ef32e876eac855022a228d675", opaque="9884d10bdc33fb591fb4027938bd2ad4"

---request end---

/!\ here the cookie is missing, voiding the authentication

requête HTTP transmise, en attente de la réponse... (http request sent, waiting for response)
---response begin---
HTTP/1.0 401 Unauthorized
Server: PasteWSGIServer/0.5 Python/2.6.4
Date: Tue, 22 Dec 2009 18:00:07 GMT
Content-Type: text/html; charset=utf-8
Pragma: no-cache
Cache-Control: no-cache
WWW-Authenticate: Digest nonce="d0969d7521f95c5487353c7daf146428", opaque="3fc42017b95f386547fe0bd396b23aff", realm="somerealm", qop="auth"
Content-Length: 3598
Set-cookie: session=a6f438620348521d4ce0d9c5ef0826f819e5a12e9aba9fc70cfb04ee2bc494225860ed1a; Path=/

---response end---
401 Unauthorized
Deleted old cookie (to be replaced.)

Stored cookie 127.0.0.1 5000 / <session> <insecure> [expiry none] session a6f438620348521d4ce0d9c5ef0826f819e5a12e9aba9fc70cfb04ee2bc494225860ed1a
Closed fd 3
ÉCHEC d'autorisation. (authorisation fails)
Saving cookies to /tmp/cookies.
Done saving cookies.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gscrivano (Posted a comment)
  • -unavailable- added by None (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 27 May 2010 10:09:37 AM UTCgscrivanoStatusNone=>Fixed
      Assigned toNone=>gscrivano
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1