Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.
Bug 326734 - Nonce expiry time for digest authentication cannot be set
Summary: Nonce expiry time for digest authentication cannot be set
Status: RESOLVED FIXED
Alias: None
Product: Jetty
Classification: RT
Component: server (show other bugs)
Version: 7.2.0   Edit
Hardware: All All
: P3 normal (vote)
Target Milestone: 7.1.x   Edit
Assignee: Greg Wilkins CLA
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-10-01 02:16 EDT by Martin Thomson CLA
Modified: 2011-01-10 15:46 EST (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Thomson CLA 2010-10-01 02:16:08 EDT 
Build Identifier: 7.1.6v20100715

In org.eclipse.jetty.security.authentication.DigestAuthenticator, the protected attribute _maxNonceAge is used to control the age of a nonce.

No mechanism is provided to change this value.

This is a useful mechanism to ensure that a nonce can be reused, but not reused indefinitely.

Reproducible: Always

Steps to Reproduce:
n/a
Comment 1 Greg Wilkins CLA 2010-10-04 18:28:36 EDT 
I've added maxNonceAge as an init parameter on the SecurityHandler.

Is that accessible enough or do you want a context attribute?
Comment 2 Martin Thomson CLA 2010-10-04 18:48:31 EDT 
I was really only looking for a setMaxNonceAge method on DigestAuthenticator, but changing the SecurityHandler (and DefaultAuthenticatorFactory, I assume) makes sense too.  I don't have a need for anything more than that right now.

Thanks for being so quick to respond.
Comment 3 Martin Thomson CLA 2010-10-25 19:33:26 EDT 
I just looked at the changes in 7.2.0.  I'm disappointed that you didn't provide a setMaxNonceAge method.  As it stands, it's not possible to change the value once the SecurityHandler is running.  We would like to be able to configure this without stopping anything - and that should be possible.

We're using DigestAuthenticator directly for various reasons.  For now, we have two options: extend DigestAuthenticator to provide the method; or implement AuthConfiguration and call setConfiguration.  We'll do the former for now.
Comment 4 Greg Wilkins CLA 2010-10-26 01:00:46 EDT 
Jetty is intended to allow classes to be easily extended so that uncommon behaviour does not need to be carried by all.

So if extension is feasible for you, then it is probably best.  If you really want it in the core, then please submit a patch and we'll consider it.

cheers
Comment 5 Greg Wilkins CLA 2011-01-10 15:46:54 EST 
no comments for a while, so I assume this is sufficient.