diff --git a/docs/c-api/http_client.h/mg_http_create_digest_auth_header.md b/docs/c-api/http_client.h/mg_http_create_digest_auth_header.md index 67b2eab8de73c063dec693fe0b730b308e300714..1842ea370e4cf038108e779342b64608f3b1574c 100644 --- a/docs/c-api/http_client.h/mg_http_create_digest_auth_header.md +++ b/docs/c-api/http_client.h/mg_http_create_digest_auth_header.md @@ -6,7 +6,7 @@ signature: | int mg_http_create_digest_auth_header(char *buf, size_t buf_len, const char *method, const char *uri, const char *auth_domain, const char *user, - const char *passwd); + const char *passwd, const char *nonce); --- Creates digest authentication header for a client request. diff --git a/mongoose.c b/mongoose.c index e2037ee50a516df5f98009d82f0b10398c185b5d..74adbb5d7ef83759b9911ac861d34b888604e9e4 100644 --- a/mongoose.c +++ b/mongoose.c @@ -7360,23 +7360,23 @@ static void mg_mkmd5resp(const char *method, size_t method_len, const char *uri, int mg_http_create_digest_auth_header(char *buf, size_t buf_len, const char *method, const char *uri, const char *auth_domain, const char *user, - const char *passwd) { + const char *passwd, const char *nonce) { static const char colon[] = ":", qop[] = "auth"; static const size_t one = 1; char ha1[33], resp[33], cnonce[40]; - snprintf(cnonce, sizeof(cnonce), "%x", (unsigned int) mg_time()); + snprintf(cnonce, sizeof(cnonce), "%lx", (unsigned long) mg_time()); cs_md5(ha1, user, (size_t) strlen(user), colon, one, auth_domain, (size_t) strlen(auth_domain), colon, one, passwd, (size_t) strlen(passwd), NULL); mg_mkmd5resp(method, strlen(method), uri, strlen(uri), ha1, sizeof(ha1) - 1, - cnonce, strlen(cnonce), "1", one, cnonce, strlen(cnonce), qop, + nonce, strlen(nonce), "1", one, cnonce, strlen(cnonce), qop, sizeof(qop) - 1, resp); return snprintf(buf, buf_len, "Authorization: Digest username=\"%s\"," "realm=\"%s\",uri=\"%s\",qop=%s,nc=1,cnonce=%s," "nonce=%s,response=%s\r\n", - user, auth_domain, uri, qop, cnonce, cnonce, resp); + user, auth_domain, uri, qop, cnonce, nonce, resp); } /* @@ -7388,7 +7388,7 @@ int mg_http_create_digest_auth_header(char *buf, size_t buf_len, static int mg_check_nonce(const char *nonce) { unsigned long now = (unsigned long) mg_time(); unsigned long val = (unsigned long) strtoul(nonce, NULL, 16); - return now < val || now - val < 3600; + return (now >= val) && (now - val < 60 * 60); } int mg_http_check_digest_auth(struct http_message *hm, const char *auth_domain, @@ -8037,7 +8037,7 @@ void mg_http_send_digest_auth_request(struct mg_connection *c, mg_printf(c, "HTTP/1.1 401 Unauthorized\r\n" "WWW-Authenticate: Digest qop=\"auth\", " - "realm=\"%s\", nonce=\"%lu\"\r\n" + "realm=\"%s\", nonce=\"%lx\"\r\n" "Content-Length: 0\r\n\r\n", domain, (unsigned long) mg_time()); } diff --git a/mongoose.h b/mongoose.h index c54bcbf7a8c8c92c1e461872a2dd0462e5ca3c9b..b6905447066df169808f307cf54f858664926606 100644 --- a/mongoose.h +++ b/mongoose.h @@ -5218,7 +5218,7 @@ struct mg_connection *mg_connect_http_opt( int mg_http_create_digest_auth_header(char *buf, size_t buf_len, const char *method, const char *uri, const char *auth_domain, const char *user, - const char *passwd); + const char *passwd, const char *nonce); #ifdef __cplusplus }