<html>
<head>
<base href="https://bugs.webkit.org/">
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - htdigestparser fails out early when malformed entries are found"
href="https://bugs.webkit.org/show_bug.cgi?id=170055#c10">Comment # 10</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - htdigestparser fails out early when malformed entries are found"
href="https://bugs.webkit.org/show_bug.cgi?id=170055">bug 170055</a>
from <span class="vcard"><a class="email" href="mailto:clopez@igalia.com" title="Carlos Alberto Lopez Perez <clopez@igalia.com>"> <span class="fn">Carlos Alberto Lopez Perez</span></a>
</span></b>
<pre>(In reply to Carlos Alberto Lopez Perez from <a href="show_bug.cgi?id=170055#c8">comment #8</a>)
<span class="quote">> I think is worse from a security point of view to go ahead and try to
> authenticate against a hash that is clearly not a md5 one (>32 chars or non
> alphanumeric) when you know it should be a md5, than to filter that entry
> and ignore it.</span >
Forget that.
Current behaviour is to disable auth (no one can use the system) if only one entry is wrong. Which is what is happening.
Can't argue about the security of that: its very secure.
But also is very unusable or un-practical: It causes the system to not work.
No idea what caused those wrong entries on the digest file, but the only options I see here are:
* Be forgiving with those entries
* Clean the digest file</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>