Permalink
Switch branches/tags
Nothing to show
Find file
Fetching contributors…
Cannot retrieve contributors at this time
44 lines (33 sloc) 2.46 KB
state management/nginx machinery
- there's a fair amount of painful parsing code devoted to unpacking the key/value fields
in the Authorize header. i have to believe i'm just unaware of an nginx built-in of some
sort that will do this part for me. however the docs only led me to a string-level
representation of the header.
- there should be a directive letting you specify that only particular users in a realm may
log in. how to handle wildcards though; maybe "*" or "any"? "_" or "none"?
rfc 2617
- currently lacks backward compatibility with clients that don't provide `qop' fields in
the Authorize header. according to the rfc the server should work without it, but is it
worth supporting the less secure version of an already not-bulletproof authentication
scheme?
- should the 401 response also offer a basic auth option if that module is also enabled
for a given location block? is there a way for one module to read another's config to
detect the overlap? or is this a module-loading-order issue (c.f., the way the fancy_index
module inserts itself before the built-in autoindex module in its HTTP_MODULES config var)?
- the opaque field is not used when generating challenges, nor is it validated when included
in an authentication request. is this a significant omission? the spec makes it seem as
though it only exists as a convenience to stash state in, but i could believe some software
out there depends upon it...
- apparently (older?) versions of internet explorer don't obey the spec when dealing with
paths that contain a query string. the client should include the query in the url used
to compute the digest, but IE truncates it at the question mark. see ‘current browser
issues’ comment here for details: http://www.xiven.com/sourcecode/digestauthentication.php
general (in)security
- OOM conditions in the shm segment are not handled at all well at the moment leading to an
easy DOS attack (presuming the shm size is set low enough to be exhaustible within the timeout
+ expire interval). Valid nonces are added to the shm and expired seconds or minutes later.
Once the shm is full no new nonces can be remembered and all auth attempts will fail until
enough space has been claimed through expiration.
Resizing the shm at runtime is somewhat daunting so for the moment the ‘solution’ is to
make sure the shm size is at the upper end of the number of requests nginx could plausibly
serve within the expiration interval.