Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 326734

Summary:	Nonce expiry time for digest authentication cannot be set
Product:	[RT] Jetty	Reporter:	Martin Thomson <martin.thomson>
Component:	server	Assignee:	Greg Wilkins <gregw>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	P3	CC:	jetty-inbox
Version:	7.2.0
Target Milestone:	7.1.x
Hardware:	All
OS:	All
Whiteboard:

Description Martin Thomson

2010-10-01 02:16:08 EDT

Build Identifier: 7.1.6v20100715

In org.eclipse.jetty.security.authentication.DigestAuthenticator, the protected attribute _maxNonceAge is used to control the age of a nonce.

No mechanism is provided to change this value.

This is a useful mechanism to ensure that a nonce can be reused, but not reused indefinitely.

Reproducible: Always

Steps to Reproduce:
n/a

Comment 1 Greg Wilkins

2010-10-04 18:28:36 EDT

I've added maxNonceAge as an init parameter on the SecurityHandler.

Is that accessible enough or do you want a context attribute?

Comment 2 Martin Thomson

2010-10-04 18:48:31 EDT

I was really only looking for a setMaxNonceAge method on DigestAuthenticator, but changing the SecurityHandler (and DefaultAuthenticatorFactory, I assume) makes sense too.  I don't have a need for anything more than that right now.

Thanks for being so quick to respond.

Comment 3 Martin Thomson

2010-10-25 19:33:26 EDT

I just looked at the changes in 7.2.0.  I'm disappointed that you didn't provide a setMaxNonceAge method.  As it stands, it's not possible to change the value once the SecurityHandler is running.  We would like to be able to configure this without stopping anything - and that should be possible.

We're using DigestAuthenticator directly for various reasons.  For now, we have two options: extend DigestAuthenticator to provide the method; or implement AuthConfiguration and call setConfiguration.  We'll do the former for now.

Comment 4 Greg Wilkins

2010-10-26 01:00:46 EDT

Jetty is intended to allow classes to be easily extended so that uncommon behaviour does not need to be carried by all.

So if extension is feasible for you, then it is probably best.  If you really want it in the core, then please submit a patch and we'll consider it.

cheers

Comment 5 Greg Wilkins

2011-01-10 15:46:54 EST

no comments for a while, so I assume this is sufficient.