<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.StileMessaggioDiPostaElettronica17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="IT" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-GB">Hi, I’m facing a problem with the digest auth server responses.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Client requests a page, server responds with 407 + nonce, client gets the page correctly.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">At every “200 OK” response the server sends a “Proxy-Authentication-Info: nextnonce …” header, even if the “nonce_garbage_interval” is 5 minutes.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Client then tries to get the next page using the same auth data used before (this is a client problem, not involving squid), gets a 407 + new nonce, then gets correctly the page making a new request with the new auth
params.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">The Squid problem here is that the server gives the “nextnonce” header in every “200 OK” response.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">POST <a href="http://my.server.com/my/page">
http://my.server.com/my/page</a> HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">[...]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">HTTP/1.1 407 Proxy Authentication Required<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Proxy-Authenticate: [digest info, nonce="<nonce1>"]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">[…]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">POST <a href="http://my.server.com/my/page">
http://my.server.com/my/page</a> HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Proxy-Authorization: [digest info, nonce="<nonce1>"]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">[…]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">HTTP/1.1 200 OK<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Proxy-Authentication-Info: nextnonce="<nonce2>"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">[…]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">(gives a new nonce at every 200 OK answer)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">POST <a href="http://my.server.com/my/page">
http://my.server.com/my/page</a> HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Proxy-Authorization: [digest info, nonce="<nonce1>"]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">[...]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">(client using the old auth params..)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">HTTP/1.1 407 Proxy Authentication Required<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Proxy-Authenticate: [digest info, nonce="<nonce3>"]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">[…]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">POST <a href="http://my.server.com/my/page">
http://my.server.com/my/page</a> HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Proxy-Authorization: [digest info, nonce=" <nonce3>"]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">[...]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">HTTP/1.1 200 OK<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Proxy-Authentication-Info: nextnonce="<nonce4>"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">[…]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">squid.conf digest settings:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"># TAG: auth_param<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">auth_param digest program /usr/bin/php /etc/squid3/mydigestscript.php<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">auth_param digest children 5<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">auth_param digest realm MyProxyRealm<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">auth_param digest nonce_garbage_interval 5 minutes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">auth_param digest nonce_max_duration 2 hours<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">auth_param digest nonce_max_count 50<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Any suggestion?<o:p></o:p></span></p>
<p class="MsoNormal" id="c1-id-6"><o:p> </o:p></p>
</div>
<p style="FONT-FAMILY: arial" id="c1-id-6"><span style="FONT-SIZE: 10pt; -webkit-text-adjust: none" id="c1-id-7"><strong id="c1-id-8">Athos Fiolo</strong><br id="c1-id-9">
Software Engineer<br id="c1-id-10">
afiolo@came.com</span><br id="c1-id-12">
<a style="FONT-FAMILY: arial" title="CAME" href="http://www.came.com/" id="c1-id-13"></a><a href="http://www.came.com" title="CAME" id="c1-id-14"><img src="cid:CAME.png" alt="" id="c1-id-15"></a><br id="c1-id-16">
<span style="font-size:8pt;" id="c1-id-17"><strong id="c1-id-18">Came S.p.A.</strong><br id="c1-id-19">
Sede Legale e Operativa: Via Martiri della Libertà, 15 - 31030 Dosson di Casier - Treviso - Italy<br id="c1-id-20">
Tel. (+39) 0422 4940 - Fax (+39) 0422 4941 - <a href="mailto:info@came.com" id="c1-id-21">
info@came.com</a> - <a href="http://www.came.com" id="c1-id-22">www.came.com</a></span></p>
<p style="FONT-FAMILY: arial" id="c1-id-23"><span style="font-size:8pt;" id="c1-id-24">Sede Operativa: Via Cornia, 1/b,c - 33079 Sesto al Reghena - Pordenone - Italy<br id="c1-id-25">
Tel. (+39) 0434 698111 - Fax (+39) 0434 698434 - <a href="mailto:infobpt@came.com" id="c1-id-26">
infobpt@came.com</a> - <a href="http://www.bpt.it" id="c1-id-27">www.bpt.it</a></span><br id="c1-id-28">
<img alt="" src="cid:LogoExpo.png" id="c1-id-29"><br id="c1-id-30">
<br id="c1-id-31">
<a href="https://www.facebook.com/pages/CAME-Italia/1604586846431438?ref=hl" id="c1-id-32"><img alt="" src="cid:facebook.png" id="c1-id-33"></a> <a href="https://twitter.com/cameglobal" id="c1-id-34"><img alt="" src="cid:twitter.png" id="c1-id-35"></a> <a href="https://www.youtube.com/user/CameChannel" id="c1-id-36"><img alt="" src="cid:youtube.png" id="c1-id-37"></a> <a href="https://www.linkedin.com/company/came?trk=top_nav_home" id="c1-id-38"><img alt="" src="cid:linkedin.png" id="c1-id-39"></a> </p>
<table style="BACKGROUND-COLOR: #d9dadb" id="c1-id-40">
<colgroup id="c1-id-41"><col id="c1-id-42"></colgroup>
<tbody id="c1-id-43">
<tr id="c1-id-44">
<td style="PADDING-BOTTOM: 0px; MARGIN: 0px 5px; PADDING-LEFT: 5px; WIDTH: 100%; PADDING-RIGHT: 5px; COLOR: #808080; FONT-SIZE: 7.5pt; PADDING-TOP: 0px; font-family: Arial" id="c1-id-45">
<p style="font-family: Arial; FONT-SIZE: 7.5pt" id="c1-id-46"><br id="c1-id-47">
<img src="cid:FooterCAME.png" alt="" id="c1-id-48"><br id="c1-id-49">
<br id="c1-id-50">
Il messaggio di posta elettronica contiene informazioni di carattere confidenziale specifiche per il destinatario. Nel caso non ne siate il destinatario, segnalatelo immediatamente al mittente ed eliminate dai vostri archivi quanto ricevuto (compresi i file
allegati). L'uso, la diffusione, distribuzione o riproduzione del presente messaggio e dei suoi allegati da parte di ogni altra persona costituisce reato. Rif. Decreto legislativo 30 giugno 2003, n. 196 - Codice in materia di protezione dei dati personali.<br id="c1-id-51">
<br id="c1-id-52">
The email message contains confidential information specific to the recipient. If you are not the recipient, write it to the sender immediately and delete from your files as received (including file attachments). Use, dissemination, distribution or reproduction
of this message and its attachments by any other person is a criminal offense. References Legislative Decree 30 June 2003, n. 196 - Code for the protection of personal data.<br id="c1-id-53">
<br id="c1-id-54">
Right to opposition:<br id="c1-id-55">
The person concerned who receives the message has the right at any time to oppose its processing for forwarding commercial messages, advertising material or direct sales proposals, by clicking on the e-mail address below (or by traditional postal services by
writing to: Came S.p.A., Via Martiri della Libertà 15, 31030 Dosson di Casier (TV) - Italy, or by sending a fax to +39 0422 4941. Furthermore the person concerned may exercise all the rights of access to the personal data as provided by art. 7, Legislative
Decree no. 196/2003, including the rights to amendment, updating and deletion, by sending an e-mail to
<a style="FONT-FAMILY: arial" href="mailto:privacy@came.com" id="c1-id-56"><span style="COLOR: #0000ff" id="c1-id-57">privacy@came.com</span></a>.<br id="c1-id-58">
<br id="c1-id-59">
</p>
</td>
</tr>
</tbody>
</table>
</body>
</html>