spring-projects / spring-projects/spring-security
Support for Newer Digest Authentication (RFC 7616)
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
RFC 7616 has been officially made available for several years now but Spring Security still only supports RFC 2617 for digest auth.
Current Behavior
The current digest auth in Spring Security uses MD5 for hashing purposes which is no longer considered secure
Context
All of our web services use digest auth and in order to ensure we continue to maintain up to date security standards in terms of crypto/hashing algorithm, we want to move to stronger hashing algorithm like SHA256
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing Spring Security’s existing RFC 2617 digest-authentication implementation and its MD5 behavior, then compare the requested behavior with RFC 7616 and SHA-256 requirements. Done means Spring Security supports the newer digest authentication standard while preserving the issue’s security goal; the issue does not name specific files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100