Skip to content

Digest Auth - missing Post request payload #1009

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
12bchl opened this issue Apr 23, 2025 · 2 comments
Open

Digest Auth - missing Post request payload #1009

12bchl opened this issue Apr 23, 2025 · 2 comments

Comments

@12bchl
Copy link

12bchl commented Apr 23, 2025

Difference in behaviour between resty v2 -> v3

Post request body is no longer transmitted for existing sessions

	cl := resty.New()
	cl.SetBaseURL(baseURL)
	cl.SetDigestAuth(username, password)

	r, err = cl.R().Get("/") 
	r, err = cl.R().SetFormData(map[string]string{"A": "B"}).Post("/somepath")

The body (encoding is irrelevant) will be present in v2, or if we comment out first GET request it would be visible in v3.

For existing sessions, using digest auth, POST request body is missing.
Verified with wireshark on client machine, no redirection issues.

Oddly I get the same issue with curl v7.88.1

Client OS: 6.1.0-31-amd64

@jeevatkm
Copy link
Member

@12bchl It is not an issue in curl or Resty v3, it is by design. Resty v3 digest should perform the same behaviour as curl. Resty v2 was not doing it appropriately, I have addressed it in v3.
Typically, the first request is made to get the value of the header WWW-Authenticate, for which the body is not required.

@12bchl
Copy link
Author

12bchl commented May 15, 2025

@jeevatkm Thank you. Appreciate your work on this great project.

I have trouble understanding this default behavior though. If I SetDigestAuth this will break my session and I won't be able to send any payload.

r, err = cl.R().SetFormData(foo).Post("bar")

Wouldn't it be better to either:

  • provide an error when executing request with payload
  • or, only execute digest logic when request fails due to lack of authorization

The nomenclature of "SetDigestAuth" seems misleading if it can't be used to handle the entire session.

curl is a just a cli-tool, not a long-lived client.
I don't think resty's "SetDigestAuth" should be equivalent to curl's "--digest" option

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants