Summary: | DIGEST auth broken on 6.0.x manager app because of redundant WWW-Authenticate header in 401.jsp | ||
---|---|---|---|
Product: | Tomcat 6 | Reporter: | Neale Rudd <neale> |
Component: | Manager application | Assignee: | Tomcat Developers Mailing List <dev> |
Status: | RESOLVED FIXED | ||
Severity: | normal | ||
Priority: | P2 | ||
Version: | 6.0.35 | ||
Target Milestone: | default | ||
Hardware: | All | ||
OS: | All | ||
Attachments: |
patch against 6.0.x trunk removing problematic lines from 401.jsp
patch against 6.0.x trunk eliminating redundant header after checking if it already exists |
Created attachment 28506 [details]
patch against 6.0.x trunk eliminating redundant header after checking if it already exists
I've proposed the fix that was applied to trunk and 7.0.x for 6.0.x. |
Created attachment 28505 [details] patch against 6.0.x trunk removing problematic lines from 401.jsp The Manager app in 6.0.35 sets WWW-Authenticate in 401.jsp. However, this seems to be already set elsewhere, and as a result of setting it again in 401.jsp, DIGEST mode can not be used for the manager app. From what I can see, this is fixed in 7.0.x but doesn't seem to have been backported to 6.0.x yet. The result is that DIGEST for Tomcat Manager can't be used on Tomcat 6 which is still very popular. To demonstrate, I changed 401.jsp to set the header name to WWW-AuthenticateREDUNDANT and here is the result: For BASIC: HTTP/1.1 401 Unauthorized Pragma: No-cache Cache-Control: no-cache Expires: Thu, 01 Jan 1970 10:00:00 EST WWW-Authenticate: Basic realm="Tomcat Manager Application" Set-Cookie: JSESSIONID=****removed****; Path=/manager WWW-AuthenticateREDUNDANT: Basic realm="Tomcat Manager Application" Content-Type: text/html Transfer-Encoding: chunked Vary: Accept-Encoding Date: Mon, 26 Mar 2012 03:39:09 GMT Server: Coyote For DIGEST: HTTP/1.1 401 Unauthorized Pragma: No-cache Cache-Control: no-cache Expires: Thu, 01 Jan 1970 10:00:00 EST WWW-Authenticate: Digest realm="Tomcat Manager Application", qop="auth", nonce="****removed****", opaque="****removed****" Set-Cookie: JSESSIONID=****removed****; Path=/manager WWW-AuthenticateREDUNDANT: Basic realm="Tomcat Manager Application" Content-Type: text/html Transfer-Encoding: chunked Vary: Accept-Encoding Date: Mon, 26 Mar 2012 03:44:07 GMT Server: Coyote You can clearly see the REDUNDANT header being set here by 401.jsp. To fix on my local versions, I simply removed the line in 401.jsp (patch1.txt). However, this deserves a cross-check by someone else before being committed in case there's some situation where it would remove authentication altogether. An alternative solution for this version is to check if the header is set, and only add it where it's not already present (patch2.txt): if(!response.containsHeader("WWW-Authenticate")) response.setHeader("WWW-Authenticater", "Basic realm=\"Tomcat Manager Application\""); ... but I'll leave that up to you. Best Regards, Neale