Hello,

I found the Curl - and I like it. Now I had problems against a MS SNA
Server with DIGEST Authentication and I found an error in the implentation
of the md5-sess protocol (see rfc 2617 + errata 2617). When using the
md5-sess, the result was not Md5 encoded and Base64 transformed.

The right peace of code should be:

   if(d->algo == CURLDIGESTALGO_MD5SESS) {
     /* nonce and cnonce are OUTSIDE the hash */
     tmp = aprintf("%s:%s:%s", ha1, d->nonce, d->cnonce);
     if(!tmp)
       return CURLE_OUT_OF_MEMORY;
     Curl_md5it(md5buf, tmp);
     free(tmp); /* free this again */
     md5_to_ascii(md5buf, ha1);
   }

Olaf
Received on 2006-05-25