Merge pull request rack#406 from dayflower/fix-time-limit

Fix request loop on non-stale nonce with time_limit parameter.
Gibheer · Aug 26, 2012 · d749c46 · d749c46
2 parents 5a4c691 + 4f81156
commit d749c46
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 1 deletion.
diff --git a/lib/rack/auth/digest/nonce.rb b/lib/rack/auth/digest/nonce.rb
@@ -38,7 +38,7 @@ def valid?
         end
 
         def stale?
-          !self.class.time_limit.nil? && (@timestamp - Time.now.to_i) < self.class.time_limit
+          !self.class.time_limit.nil? && (Time.now.to_i - @timestamp) > self.class.time_limit
         end
 
         def fresh?

diff --git a/test/spec_auth_digest.rb b/test/spec_auth_digest.rb
@@ -153,6 +153,20 @@ def assert_bad_request(response)
     end
   end
 
+  should 'not rechallenge if nonce is not stale' do
+    begin
+      Rack::Auth::Digest::Nonce.time_limit = 10
+
+      request_with_digest_auth 'GET', '/', 'Alice', 'correct-password', :wait => 1 do |response|
+        response.status.should.equal 200
+        response.body.to_s.should.equal 'Hi Alice'
+        response.headers['WWW-Authenticate'].should.not =~ /\bstale=true\b/
+      end
+    ensure
+      Rack::Auth::Digest::Nonce.time_limit = nil
+    end
+  end
+
   should 'rechallenge with stale parameter if nonce is stale' do
     begin
       Rack::Auth::Digest::Nonce.time_limit = 1