nginx-http-auth-digest
nginx-http-auth-digest copied to clipboard
samizdatco
Digest Authentication for Nginx
I am using nginx 1.21.3 and installed it from source compiling it with this module. The authentication works in that it asks the user for username and password. But I...
We discovered a bug with IPv6 authentication: the ngx_memcpy() in the function ngx_http_auth_digest_evasion_tracking() causes a segmentation fault because node.src_addr is defined as struct sockaddr, that is too small to contain...
the opaque field is not used when generating challenges, nor is it validated when included in an authentication request. is this a significant omission? the spec makes it seem as...
In order to pass the username along to a fastcgi application (trac), I had to set a value for remote user explicitly like so as a workaround: ``` if ($http_authorization...
the module currently lacks backward compatibility with clients that don't provide ‘qop’ fields in the Authorize header. according to the RFC the server should work without it, but is it...
there's a fair amount of painful parsing code devoted to unpacking the key/value fields in the Authorize header. i have to believe i'm just unaware of an nginx built-in of...
Hi, I have issues using IPv6 authentication. It works in IPv4. It initially crashed the workers, seen no similar issues opened or closed but then I realized it's in the...
Hello! I was analyzing **Nginx** modules with the **Svace** static analyzer. It has found an inconsistency code at the following sections of the code: https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L1227-L1247 and https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L1286-L1308 --- In both...
https://github.com/chobits/ngx_http_proxy_connect_module adds support for proxy CONNECT requests to nginx. This patch adds support to this Digest Authentication module to work along with the aforementioned one. New behaviour will only be...
