restify / restify/clients

Help Wanted - FIPS: Is there a way to not add MD5 hash to header on post, this is needed for FIPS

Open
#166 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
58
Forks
35
Avg merge
22h 4m
Merged PRs (30d)
10

Description

Copied from restify/node-restify#1637

Node version 6.12.3
Restify version 7.1.0

Hi, we are attempting to run our application with FIPS enabled Node, as per a requirement that we have. When using restify, I noticed that the JSONClient appears to always add an MD5 hash to the headers here in the StringClient.js

`

StringClient.prototype.write = function write(options, body, callback) {

var self = this;
var normalizedBody = body;
var proto = StringClient.prototype;

if (normalizedBody !== null && typeof (normalizedBody) !== 'string') {
    normalizedBody = qs.stringify(normalizedBody);
}


function _write(data) {
    if (data) {
        var hash = crypto.createHash('md5');
        hash.update(data, 'utf8');
        options.headers['content-md5'] = hash.digest('base64');
    }

`

MD5 hashes are not allowed by FIPS, so I need to somehow disable this? If i comment out this MD5 header locally, the request works in FIPS-MODE without issue. The problem is while this code is here the FIPS module will not allow us to move past the point "crypto.createHash"

Do we need the hash with every request? Is there a way to disable this option? I'm not that familiar with restify, and could not find a way to do it.

If not, can we get a new feature added that will allow us to by-pass this piece of code with an option?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in StringClient.js at StringClient.prototype.write, where crypto.createHash('md5') adds the content-md5 header. Check how the client handles request options and determine a way to bypass this hashing for FIPS-enabled Node. Done means requests can be sent without invoking the MD5 operation while retaining the existing behavior by default.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.