{"action":"created","issue":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/9668","repository_url":"https://api.github.com/repos/cakephp/cakephp","labels_url":"https://api.github.com/repos/cakephp/cakephp/issues/9668/labels{/name}","comments_url":"https://api.github.com/repos/cakephp/cakephp/issues/9668/comments","events_url":"https://api.github.com/repos/cakephp/cakephp/issues/9668/events","html_url":"https://github.com/cakephp/cakephp/issues/9668","id":186028635,"number":9668,"title":"Digest Authentication doesn't actively use the nonce, so a replay attack is possible","user":{"login":"JelmerD","id":2372882,"avatar_url":"https://avatars.githubusercontent.com/u/2372882?v=3","gravatar_id":"","url":"https://api.github.com/users/JelmerD","html_url":"https://github.com/JelmerD","followers_url":"https://api.github.com/users/JelmerD/followers","following_url":"https://api.github.com/users/JelmerD/following{/other_user}","gists_url":"https://api.github.com/users/JelmerD/gists{/gist_id}","starred_url":"https://api.github.com/users/JelmerD/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JelmerD/subscriptions","organizations_url":"https://api.github.com/users/JelmerD/orgs","repos_url":"https://api.github.com/users/JelmerD/repos","events_url":"https://api.github.com/users/JelmerD/events{/privacy}","received_events_url":"https://api.github.com/users/JelmerD/received_events","type":"User","site_admin":false},"labels":[{"id":60504544,"url":"https://api.github.com/repos/cakephp/cakephp/labels/Defect","name":"Defect","color":"f7c6c7","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/cakephp/cakephp/milestones/95","html_url":"https://github.com/cakephp/cakephp/milestone/95","labels_url":"https://api.github.com/repos/cakephp/cakephp/milestones/95/labels","id":1906253,"number":95,"title":"3.4.0","description":"Backwards compatible features for 3.x. See the [3.4-Roadmap](https://github.com/cakephp/cakephp/wiki/3.4-Roadmap).","creator":{"login":"markstory","id":24086,"avatar_url":"https://avatars.githubusercontent.com/u/24086?v=3","gravatar_id":"","url":"https://api.github.com/users/markstory","html_url":"https://github.com/markstory","followers_url":"https://api.github.com/users/markstory/followers","following_url":"https://api.github.com/users/markstory/following{/other_user}","gists_url":"https://api.github.com/users/markstory/gists{/gist_id}","starred_url":"https://api.github.com/users/markstory/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markstory/subscriptions","organizations_url":"https://api.github.com/users/markstory/orgs","repos_url":"https://api.github.com/users/markstory/repos","events_url":"https://api.github.com/users/markstory/events{/privacy}","received_events_url":"https://api.github.com/users/markstory/received_events","type":"User","site_admin":false},"open_issues":72,"closed_issues":141,"state":"open","created_at":"2016-07-27T02:20:40Z","updated_at":"2016-12-12T08:22:50Z","due_on":"2016-12-18T00:00:00Z","closed_at":null},"comments":9,"created_at":"2016-10-28T21:40:37Z","updated_at":"2016-12-13T02:21:40Z","closed_at":"2016-10-31T17:15:17Z","body":"This is a (multiple allowed):\n- [x] bug\n- [ ] enhancement\n- [ ] feature-discussion (RFC)\n- CakePHP Version: 3.3.6\n- Platform and Target: Vagrant bento/debian-8.6, PHP7.0, MySQL. Request tested via Postman and cURL.\n### What I did\n\nI have set up a simple Digest Authentication (the app I'm building is going to be the core of a simple API centerend architecture).\n\n```\n$this->loadComponent('Auth', [\n    'authenticate' => [\n        'Digest' => [\n            'userModel' => 'ApiClients',\n            'fields' => ['username' => 'client', 'password' => 'digest_hash'],\n            'realm' => 'api'\n        ]\n    ],\n    'storage' => 'Memory',\n    'unauthorizedRedirect' => false,\n]);\n```\n\n(The response=\"xxx\" is of course a correct md5 hash)\n\nWhen I make a request via Postman or cURL with the following header: `Authorization: Digest username=\"jelmer\", realm=\"api\", response=\"xxx\"` it fails as expected, because as you can see at https://github.com/cakephp/cakephp/blob/master/src/Auth/DigestAuthenticate.php#L168 it returns false because not all required keys are provided.\n\nSo I add the missing keys, and thus sending the following header: `Authorization: Digest username=\"jelmer\", realm=\"api\", nonce=\"random\", uri=\"/ping\", qop=auth, nc=8, cnonce=\"random\", response=\"xxx\", opaque=\"random\"`. And yes, I really provided `random` for the nonce, cnonce, opaque and nc keys.\n### What happened\n\nIt authenticates me with truly random nonce, cnonce, opaque and nc keys.\n### Expected Behavior\n\nI expected it to block the request, since the nonce value wasn't requested from the server earlier on, so it wasn't provided to me via a 401 response.\n- I expect the DigestAuthenticate to return a nonce and other keys when I do not provide them.\n- I expect the DigestAuthenticate to block the request when I provide a wrong nonce or other keys.\n\nExpectations based on http://www.webdav.org/specs/rfc2617.html#rfc.section.3.3\n\nI'm not that well known with Digest authentication and I'm really trying to understand it all, but as far as I'm concerned the RFC's and other articles about Digest, I expect it to make a handshake first, before I'm authenticated to request data.\n"},"comment":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/comments/266616500","html_url":"https://github.com/cakephp/cakephp/issues/9668#issuecomment-266616500","issue_url":"https://api.github.com/repos/cakephp/cakephp/issues/9668","id":266616500,"user":{"login":"markstory","id":24086,"avatar_url":"https://avatars.githubusercontent.com/u/24086?v=3","gravatar_id":"","url":"https://api.github.com/users/markstory","html_url":"https://github.com/markstory","followers_url":"https://api.github.com/users/markstory/followers","following_url":"https://api.github.com/users/markstory/following{/other_user}","gists_url":"https://api.github.com/users/markstory/gists{/gist_id}","starred_url":"https://api.github.com/users/markstory/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markstory/subscriptions","organizations_url":"https://api.github.com/users/markstory/orgs","repos_url":"https://api.github.com/users/markstory/repos","events_url":"https://api.github.com/users/markstory/events{/privacy}","received_events_url":"https://api.github.com/users/markstory/received_events","type":"User","site_admin":false},"created_at":"2016-12-13T02:21:40Z","updated_at":"2016-12-13T02:21:40Z","body":"Have you run into clients that don't provide `nc` where requiring it is problematic?"}}
{"actor":{"display_login":"markstory"}}