| Subject: | Error in Authentication Digest Implementation |
Hi,
RFC 2617 says to calculate the digest of the body only if the auth-int
is set in the qop option. The current version of LWP::Authen::Digest
just ignores this and caculates the digest always when the method is
POST or PUT.
The following lines will fix it:
my %resp = map { $_ => $auth_param->{$_} } qw(realm nonce opaque);
@resp{qw(username uri response algorithm)} = ($user, $uri,
$digest, "MD5");
# changes start here
my $auth_qop = $auth_param->{qop} || "";
if ($auth_qop eq "auth") {
@resp{qw(qop cnonce nc)} = ("auth", $cnonce, $nc);
}
my(@order) = qw(username realm qop algorithm uri nonce nc cnonce
response);
if($request->method =~ /^(?:POST|PUT)$/ && $auth_qop eq 'auth-
int' ) {
# changes end here
$md5->add($request->content);
my $content = $md5->hexdigest;
HTH
esskar