Kong / Kong/insomnia

No body in POST requests when digest auth is enabled

Open
#2,190 2 comments 1 reaction 0 assignees View on GitHub
B-bug needs-triage
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

**Describe the bug**
Reproduced with XML body.
When digest auth is enabled, request contains only URL, but no body. So server just drop connection, no reply with 401 and WWW-Authenticate.

**To Reproduce**
Steps to reproduce the behavior:
1. Create new POST request
2. Select XML body type
3. Paste any XML into XML-field
4. Select Digest Auth and set USERNAME and PASSWORD fields
2. Click on 'Send'
4. See error

Wireshark window screenshot demonstrate this issue results.
Pay attention to the Content-Length : 0, and Content-Type : application/xml

**Expected behavior**
1. Send full request (with body)
2. Get 401 Unauthorized reply from server with WWW-Authenticate
3. Send full request again with Authorization
4. Get reply

**Screenshots**
![Screenshot from 2020-05-18 19-17-05](https://user-images.githubusercontent.com/47142340/82237283-10f90a00-993e-11ea-94a5-376f5a2c3045.png)

![Screenshot from 2020-05-18 19-35-24](https://user-images.githubusercontent.com/47142340/82237779-e196cd00-993e-11ea-8e43-8e78f6977476.png)

**Desktop (please complete the following information):**
- OS: Ubuntu 18.04.4 LTS
- Installation Method: homebrew
- App Version v7.1.1

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the XML POST with Digest Auth in Insomnia v7.1.1 and capture the request in Wireshark, as shown in the issue screenshots. Trace the request and authentication flow until the body is lost; done means the initial request reaches the server with its body, the 401 response is received, and the authenticated retry also includes the body.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.