jaredhanson / jaredhanson/passport-http

Digest: return algorithm in response header

Open
#73 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
261
Forks
112
PR merge metrics
No merged PRs in 30d

Description

I can see that the [DigestStrategy](https://github.com/jaredhanson/passport-http/blob/master/lib/passport-http/strategies/digest.js#L142) already supports md5-sess

But then why in the response header it is not returned
According to the [rfc2617#3.2.1](https://tools.ietf.org/html/rfc2617#section-3.2.1) it would be assumed as md5 always

> algorithm
> A string indicating a pair of algorithms used to produce the digest
> and a checksum. If this is not present it is assumed to be "MD5".
> If the algorithm is not understood, the challenge should be ignored
> (and a different one used, if there is more than one).

Since this strategy support both md5 and md5-sess, should the response header include both of them
```Digest realm="", algorithm="MD5,MD5-sess", nonce="", qop=""```

Contributor guide

Open the contributing guide

Research direction

Start with lib/passport-http/strategies/digest.js around line 142 and compare how md5 and md5-sess are represented in the response header. Read the referenced RFC 2617 section to confirm the expected algorithm syntax. Done means the header accurately advertises the supported algorithm behavior and the relevant cases are verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.