Hi,
when looking into HTTP_Basic/Digest for iOS, we noticed a problem with that, on the Controller demo.
Steps to reproduce
- Clone the AG-Controller demo
- Update the
web.xml
to use the BASIC Filter (here and here). - Make SURE that the Digiest section is commented out.
- Deploy the
WAR
to your JBoss Application Server
Now some tests with BASIC (and the default user john:123
):
curl -u "john:123" "http://localhost:8080/aerogear-controller-demo/autobots" -v
This works, as expected!
curl -u "john:007" "http://localhost:8080/aerogear-controller-demo/autobots" -v
This does NOT work, as expected!
I noticed the server does return the Set-Cookie:
response header, so the cookie can/will be stored on the client.
Now let's do this:
curl --basic -b cookies.txt -c cookies.txt -u john:123 \
"http://localhost:8080/aerogear-controller-demo/autobots" -v
Perfect, works as well
But now, let's do this:
curl --basic -b cookies.txt -c cookies.txt -u john:007 \
"http://localhost:8080/aerogear-controller-demo/autobots" -v
Unfortunatley, this works as well, since the session is reused, due to the cookies... So, when the session is stored on the client, it is possible to switch the credentials "on the fly".
-
Not really sure, but for Basic/Digest should the server really send
Set-Cookie:
response header back to the client ? -
Not sure this is something on the controller, AG-Security or even PicketLink, but perhaps the
Set-Cookie:
could be removed, when sending the response for Basic/Digest