jaredhanson / jaredhanson/passport-http
Digest: return algorithm in response header
- Dominant language
- JavaScript
- Stars
- 261
- Forks
- 112
- PR merge metrics
- No merged PRs in 30d
Description
I can see that the [DigestStrategy](https://github.com/jaredhanson/passport-http/blob/master/lib/passport-http/strategies/digest.js#L142) already supports md5-sess
But then why in the response header it is not returned
According to the [rfc2617#3.2.1](https://tools.ietf.org/html/rfc2617#section-3.2.1) it would be assumed as md5 always
> algorithm
> A string indicating a pair of algorithms used to produce the digest
> and a checksum. If this is not present it is assumed to be "MD5".
> If the algorithm is not understood, the challenge should be ignored
> (and a different one used, if there is more than one).
Since this strategy support both md5 and md5-sess, should the response header include both of them
```Digest realm="", algorithm="MD5,MD5-sess", nonce="", qop=""```
Contributor guide
Research direction
Start with lib/passport-http/strategies/digest.js around line 142 and compare how md5 and md5-sess are represented in the response header. Read the referenced RFC 2617 section to confirm the expected algorithm syntax. Done means the header accurately advertises the supported algorithm behavior and the relevant cases are verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100