Cleanup: drop Auth::User::proxy_auth_list header cache

This list/cache was originally used to short-circuit auth helper lookups
based on previousy seen [Proxy-]Authorization header strings.
However, that permitted replay attacks in most auth schemes and has been
replaced by scheme-specific mechanisms:

* Basic and Digest credentials are cached in the global user name cache
  wih additional nonce/password comparisons to verify located entries.

* NTLM and Negotiate credentials are cached in the ConnStateData with
  exact-match comparison done to verify tokens.

diff --git a/src/auth/User.cc b/src/auth/User.cc
index 739cbc2e24aa616cf092772e703df0de9c15713a..7c2713e7b7a8103071f3b6ce7af32eeee1ae2bcb 100644 (file)
--- a/src/auth/User.cc
+++ b/src/auth/User.cc
@@ -59,7 +59,6 @@ Auth::User::User(Auth::Config *aConfig, const char *aRequestRealm) :
         username_(NULL),
         requestRealm_(aRequestRealm)
 {
-    proxy_auth_list.head = proxy_auth_list.tail = NULL;
     proxy_match_cache.head = proxy_match_cache.tail = NULL;
     ip_list.head = ip_list.tail = NULL;
     debugs(29, 5, HERE << "Initialised auth_user '" << this << "'.");
@@ -91,7 +90,6 @@ Auth::User::absorb(Auth::User::Pointer from)
 {
     /*
      * XXX Incomplete: it should merge in hash references too and ask the module to merge in scheme data
-     *  dlink_list proxy_auth_list;
      *  dlink_list proxy_match_cache;
      */
 

diff --git a/src/auth/User.h b/src/auth/User.h
index 74de93cfd83ade3f639b31be864c0bdf27d62c18..ba5dd5cfe3d8c34d17b3931566b80335367c30a7 100644 (file)
--- a/src/auth/User.h
+++ b/src/auth/User.h
@@ -71,8 +71,6 @@ public:
     Auth::Type auth_type;
     /** the config for this user */
     Auth::Config *config;
-    /** we may have many proxy-authenticate strings that decode to the same user */
-    dlink_list proxy_auth_list;
     dlink_list proxy_match_cache;
     size_t ipcount;
     long expiretime;

diff --git a/src/auth/negotiate/User.cc b/src/auth/negotiate/User.cc
index a4b9c42373f7c1148eaf1ecb6c4223ed087b9163..d1808bec7817275abd4a2bcf8d39c440c5d57377 100644 (file)
--- a/src/auth/negotiate/User.cc
+++ b/src/auth/negotiate/User.cc
@@ -6,7 +6,6 @@
 Auth::Negotiate::User::User(Auth::Config *aConfig, const char *aRequestRealm) :
         Auth::User(aConfig, aRequestRealm)
 {
-    proxy_auth_list.head = proxy_auth_list.tail = NULL;
 }
 
 Auth::Negotiate::User::~User()

diff --git a/src/auth/ntlm/User.cc b/src/auth/ntlm/User.cc
index cc5d9c704d7d45d7e091222e5344a57f2d2ff8b1..bbe6f73832d9a05ccbc69ecbf34a9a4328f1bd5d 100644 (file)
--- a/src/auth/ntlm/User.cc
+++ b/src/auth/ntlm/User.cc
@@ -6,7 +6,6 @@
 Auth::Ntlm::User::User(Auth::Config *aConfig, const char *aRequestRealm) :
         Auth::User(aConfig, aRequestRealm)
 {
-    proxy_auth_list.head = proxy_auth_list.tail = NULL;
 }
 
 Auth::Ntlm::User::~User()