Digest auth new by pratt4 · Pull Request #2098 · AsyncHttpClient/async-http-client

pratt4 · 2025-06-10T14:42:11Z

This is build on top of #2089

and still some changes are required around new testcases and failing testcases

closes#2068

hyperxpro · 2025-06-11T21:44:39Z

I'll have a look on the weekend. :)

hyperxpro · 2025-06-16T22:56:53Z

I think only the auth-int implementation is not complete.

pratt4 · 2025-06-18T16:54:53Z

Thanks @hyperxpro for pointing that out! I’ve started implementing auth-int
I will push phase 1 in 1-2 days

pratt4 · 2025-07-20T08:38:50Z

things to do

Support unlimited size request bodies using streaming: implement DigestingBodyGenerator that hashes while streaming (no upfront buffer), lifting the 10 MB limit
Adding a repeatability contract (e.g... isRepeatable()) to BodyGenerator so client auto-selects buffering or streaming modes
Optimization of FileBodyGenerator hashing by using zero-copy techniques (FileChannel + ByteBuffer or mmmap slices).
seamless auth-int support for ReactiveStreams and multipart body generators, preserving async back-pressure.
Negotiation of strongest hash algorithm automatically when server advertises multiple options (SHA-512-256 first, then SHA-256, then MD5).
Implementation of the RFC 7616 userhash=true parameter and handle UTF-8 encoded usernames properly.
Performance improvements on hex-encoding method with lookup-table-based implementation and consider mmap-based hashing.
Integration tests

pratt4 · 2025-07-20T08:40:05Z

@hyperxpro i have fews questions it would be helpfull if you answer them

1)in Proxy auth is auth-int relevant? because as far as i know proxies happen before getting body
2) currently i dont think the code increments nonce infact it uses DEFAULT_NC=00000001
that means every request that uses Digest today sends nc="00000001". Most servers tolerate that because they don’t enforce nonce-count, but a strict implementation (especially when it also requires auth-int) will expect the counter to rise.
shall we increment it or it is kept default for some reason?

Thanks!

pratt4 · 2025-07-20T08:49:32Z

+ * @return 2×length lower-case hex string
+ * @throws IllegalArgumentException if {@code bytes} is null
+ */
+ public static String bytesToHex(byte[] bytes) {


need to optimize this

hyperxpro · 2025-07-25T18:05:46Z

Thanks. I will try to review it ASAP.

pratt4 · 2025-08-15T17:17:10Z

Hi @hyperxpro
can you please review this whenever you get time..
so that i can quickly wrap this up as soon as possible

Thanks!

hyperxpro · 2025-08-16T17:26:53Z

@pratt4 Sorry, I was behind schedule. Let me take this up now.

hyperxpro · 2025-08-16T18:49:02Z

+
+ MessageDigest md = MessageDigestUtils.pooledMessageDigest(hashAlgorithm);
+ try {
+ md.update(responseInput.getBytes(StandardCharsets.ISO_8859_1));


We can reference wireCharset.

hyperxpro

Few comments

hyperxpro · 2025-08-16T18:49:37Z

+ md.update(responseInput.getBytes(StandardCharsets.ISO_8859_1));
+ return MessageDigestUtils.bytesToHex(md.digest());
+ } finally {
+ md.reset();


We don't need to reset MessageDigest since we will return the hash and it won't be reused anymore.

hyperxpro · 2025-08-16T18:49:48Z

+ // For -sess: HA1 = H(H(username:realm:password):nonce:cnonce)
+ String sessInput = ha1 + ":" + realm.getNonce() + ":" + realm.getCnonce();
+ md.reset();
+ md.update(sessInput.getBytes(StandardCharsets.ISO_8859_1));


Use wireCs.

hyperxpro · 2025-08-16T18:49:59Z

+
+ return ha1;
+ } finally {
+ md.reset();


Reset is not required.

hyperxpro · 2025-08-16T18:50:27Z

+ md.update(bb);
+ return MessageDigestUtils.bytesToHex(md.digest());
+ } finally {
+ md.reset();


Reset is not required.

hyperxpro · 2025-08-16T18:50:44Z

+ md.update(request.getStringData().getBytes(charset));
+ return MessageDigestUtils.bytesToHex(md.digest());
+ } finally {
+ md.reset();


Reset is not required.

hyperxpro · 2025-08-16T18:50:52Z

+
+ return MessageDigestUtils.bytesToHex(md.digest());
+ } finally {
+ md.reset();


Reset is not required.

hyperxpro · 2025-08-16T18:51:04Z

+ md.update(request.getByteData());
+ return MessageDigestUtils.bytesToHex(md.digest());
+ } finally {
+ md.reset();


Reset is not required.

hyperxpro · 2025-08-16T18:51:15Z

+ throw new RuntimeException("Failed to hash request body", ioe);
+ } finally {
+ try {
+ md.reset();


Reset is not required.

hyperxpro · 2025-08-16T18:51:50Z

+ return MessageDigestUtils.bytesToHex(md.digest());
+
+ } catch (IOException ioe) {
+ throw new RuntimeException("Failed to hash request body", ioe);


This should be IOException not RuntimeException, because it is caused by an IO operation.

hyperxpro · 2025-08-16T18:52:21Z

+ md.update(bytes);
+ return MessageDigestUtils.bytesToHex(md.digest());
+ } catch (IOException ioe) {
+ throw new RuntimeException("Failed to read file for auth-int hash", ioe);


This should be IOException not RuntimeException, because it is caused by an IO operation.

hyperxpro · 2025-08-16T19:00:13Z

@pratt4 I will merge this into another branch where I will test it with the actual server implementation and see how it behaves before finally pushing to the main branch. It also requires some code formatting.

Overall, great work! Thanks a lot :)

pratt4 · 2025-08-18T19:12:10Z

@hyperxpro thanks for the review!

I’m happy to fix the formatting issues myself if you can point them out along with the suggested changes

and about testing in another branch.... i was just curious,
would that mean merging this PR into a staging/test branch, or pulling the code manually?
I only ask to make sure it doesn’t end up as a “zombie PR”(if code is pulled manually) that will be harder for me to track later in future.

Also, the improvements which I mentioned earlier in the previous comments for that i will create a separate PR,
so this one stays focused and not overloaded.

hyperxpro · 2025-08-21T22:56:51Z

It won't be a zombie one; it will ship with the next release, but I need to test it. We don't have "SNAPSHOT" maven for this, so merging to a test branch is the only option before confirming full compliance with other implementations.

hyperxpro · 2025-09-23T18:25:20Z

Merged this into another branch for now until I address remaining issues before merging into main.

pratt4 · 2025-09-23T18:56:46Z

Thanks @hyperxpro

Sorry I was little occupied in personal work all these days and couldn't fix/contribute to this branch...
I will try to stay consistent as much as possible from now onwards

please feel tag any issue related to this feature and i will try to resolve it asap

hyperxpro · 2025-09-23T19:53:23Z

@pratt4 - No problem at all, thanks a lot for the great work.

I will tag you in the final PR for the main branch.

This is build on top of #2089 and still some changes are required around new testcases and failing testcases closes#2068 --------- Co-authored-by: Aayush Atharva <aayush@shieldblaze.com>

hyperxproand others added 2 commits May 11, 2025 00:57

Implement HTTP Digest Access Authentication
6222d4b

RFC 7616: honour charset=UTF-8 in Digest authAsyncHttpClient#2068
867f50e

pratt4 marked this pull request as draft June 10, 2025 14:42

Merge branch 'main' into digest-auth-new
2709575

pratt4 force-pushed the digest-auth-new branch 2 times, most recently from db10c8e to 735ab1cCompare June 15, 2025 07:12

RFC 7616: fixed failing testcases in pipelines
126404c

pratt4 force-pushed the digest-auth-new branch from 735ab1c to 126404cCompare June 15, 2025 07:30

pratt4and others added 3 commits July 18, 2025 00:46

Merge branch 'main' into digest-auth-new
3536f37

RFC 7616: added support to auth-int (phase-1)AsyncHttpClient#2068
d3a6fb5

Merge branch 'main' into digest-auth-new
2815a12

pratt4 mentioned this pull request Jul 20, 2025
any plan for RFC7616? #2068
Closed

pratt4 commented Jul 20, 2025
View reviewed changes

pratt4 marked this pull request as ready for review August 9, 2025 18:25

hyperxpro requested a review from Copilot August 16, 2025 18:38

This comment was marked as outdated.
Sign in to view

hyperxpro requested a review from Copilot August 16, 2025 18:46

This comment was marked as outdated.
Sign in to view

hyperxpro reviewed Aug 16, 2025
View reviewed changes

hyperxpro requested changes Aug 16, 2025
View reviewed changes

Merge branch 'main' into digest-auth-new
2c8a0f5

hyperxpro changed the base branch from main to rfc-7616September 23, 2025 18:24

hyperxpro merged commit a5763a6 into AsyncHttpClient:rfc-7616Sep 23, 2025
3 checks passed

hyperxpro added a commit that referenced this pull request Mar 15, 2026
Digest auth new (#2098)
05c437e
This is build on top of #2089 and still some changes are required around new testcases and failing testcases closes#2068 --------- Co-authored-by: Aayush Atharva <aayush@shieldblaze.com>

Uh oh!

Conversation

pratt4 commented Jun 10, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hyperxpro commented Jun 11, 2025

Uh oh!

hyperxpro commented Jun 16, 2025

Uh oh!

pratt4 commented Jun 18, 2025

Uh oh!

pratt4 commented Jul 20, 2025

Uh oh!

pratt4 commented Jul 20, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hyperxpro commented Jul 25, 2025

Uh oh!

pratt4 commented Aug 15, 2025

Uh oh!

hyperxpro commented Aug 16, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hyperxpro left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hyperxpro commented Aug 16, 2025

Uh oh!

pratt4 commented Aug 18, 2025

Uh oh!

hyperxpro commented Aug 21, 2025

Uh oh!

Uh oh!

hyperxpro commented Sep 23, 2025

Uh oh!

pratt4 commented Sep 23, 2025

Uh oh!

hyperxpro commented Sep 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pratt4 commented Jun 10, 2025•
edited
Loading

pratt4 commented Jul 20, 2025•
edited
Loading