2003-05-18 23:49 hno

2003-05-18 23:49  hno
2003-05-24 13:08  robertc

Bug #630: digest authentication and buggy browsers

This patch does four things:

* correct signalling of stale digest nonces

* auth_param digest check-nonce-count off option to completely
disable the nonce count check. Needed to work around Konqueror and
certain other broken digest qop implementations.

* auth_param digest post_workaround on to work around certain
broken browsers sending POST requests with a GET digest response

* changes the default of nonce_strictness to off. It is to early to
use strict nonce count increase by one checks, and even in the long
run this is probably not wanted. Enforcing increase by one does not
really add to security, only complexity.