Help Wanted - FIPS: Is there a way to not add MD5 hash to header on post, this is needed for FIPS
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 58
- Forks
- 35
- Avg merge
- 22h 4m
- Merged PRs (30d)
- 10
Description
Copied from restify/node-restify#1637
Node version 6.12.3
Restify version 7.1.0
Hi, we are attempting to run our application with FIPS enabled Node, as per a requirement that we have. When using restify, I noticed that the JSONClient appears to always add an MD5 hash to the headers here in the StringClient.js
`
StringClient.prototype.write = function write(options, body, callback) {
var self = this;
var normalizedBody = body;
var proto = StringClient.prototype;
if (normalizedBody !== null && typeof (normalizedBody) !== 'string') {
normalizedBody = qs.stringify(normalizedBody);
}
function _write(data) {
if (data) {
var hash = crypto.createHash('md5');
hash.update(data, 'utf8');
options.headers['content-md5'] = hash.digest('base64');
}
`
MD5 hashes are not allowed by FIPS, so I need to somehow disable this? If i comment out this MD5 header locally, the request works in FIPS-MODE without issue. The problem is while this code is here the FIPS module will not allow us to move past the point "crypto.createHash"
Do we need the hash with every request? Is there a way to disable this option? I'm not that familiar with restify, and could not find a way to do it.
If not, can we get a new feature added that will allow us to by-pass this piece of code with an option?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in StringClient.js at StringClient.prototype.write, where crypto.createHash('md5') adds the content-md5 header. Check how the client handles request options and determine a way to bypass this hashing for FIPS-enabled Node. Done means requests can be sent without invoking the MD5 operation while retaining the existing behavior by default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100