-
-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Fix algorithm case preservation in DigestAuthMiddleware #11352
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #11352 +/- ##
=======================================
Coverage 98.76% 98.76%
=======================================
Files 129 129
Lines 43375 43416 +41
Branches 2323 2324 +1
=======================================
+ Hits 42838 42879 +41
Misses 383 383
Partials 154 154
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
CodSpeed Performance ReportMerging #11352 will not alter performanceComparing Summary
|
Backport to 3.12: 💚 backport PR created✅ Backport PR branch: Backported as #11353 🤖 @patchback |
(cherry picked from commit 6deecea)
Backport to 3.13: 💚 backport PR created✅ Backport PR branch: Backported as #11354 🤖 @patchback |
(cherry picked from commit 6deecea)
…n DigestAuthMiddleware (#11354) Co-authored-by: J. Nick Koston <[email protected]> Fixes home-assistant/core#149196
…n DigestAuthMiddleware (#11353) Co-authored-by: J. Nick Koston <[email protected]> Fixes home-assistant/core#149196
What do these changes do?
This PR fixes a case sensitivity issue in
DigestAuthMiddleware
where the algorithm name from the server's challenge was being converted to uppercase in the Authorization header response. Some servers (like Prusa printers) are case-sensitive and expect the exact algorithm case to be preserved.The fix preserves the original algorithm case from the WWW-Authenticate challenge while still using uppercase internally for hash function lookups and algorithm type checking.
Are there changes in behavior for the user?
Yes, but only for users connecting to case-sensitive digest auth servers. The middleware will now preserve the exact algorithm case from the server's challenge instead of converting it to uppercase. This improves compatibility with servers that expect exact case matching (e.g., servers sending
algorithm="MD5-sess"
will now receivealgorithm=MD5-sess
instead ofalgorithm=MD5-SESS
).Is it a substantial burden for the maintainers to support this?
No. This is a minimal change that adds one variable to store the original algorithm case. The fix is backward compatible and doesn't change the API. The implementation is straightforward and includes comprehensive tests to prevent regression.
Related issue number
Fixes home-assistant/core#149196
Checklist
CONTRIBUTORS.txt
CHANGES/
foldername it
<issue_or_pr_num>.<type>.rst
(e.g.588.bugfix.rst
)if you don't have an issue number, change it to the pull request
number after creating the PR
.bugfix
: A bug fix for something the maintainers deemed animproper undesired behavior that got corrected to match
pre-agreed expectations.
.feature
: A new behavior, public APIs. That sort of stuff..deprecation
: A declaration of future API removals and breakingchanges in behavior.
.breaking
: When something public is removed in a breaking way.Could be deprecated in an earlier release.
.doc
: Notable updates to the documentation structure or buildprocess.
.packaging
: Notes for downstreams about unobvious side effectsand tooling. Changes in the test invocation considerations and
runtime assumptions.
.contrib
: Stuff that affects the contributor experience. e.g.Running tests, building the docs, setting up the development
environment.
.misc
: Changes that are hard to assign to any of the abovecategories.
Make sure to use full sentences with correct case and punctuation,
for example:
Use the past tense or the present tense a non-imperative mood,
referring to what's changed compared to the last released version
of this project.