fix(prusalink): increase nonce valid period #3371
Conversation
| @@ -297,13 +297,11 @@ bool RequestParser::nonce_valid(uint64_t nonce_to_check) const { | |||
| uint32_t random = static_cast<uint32_t>(nonce_to_check >> 32); | |||
| uint32_t time = nonce_to_check & 0xffffffff; | |||
| uint32_t age = ticks_s() - time; | |||
| // Make valid period for POST and PUT longer, to avoid infinit uploading | |||
| // loops if nonce get stale for upload request. | |||
| uint32_t max_valid_age = has_body(method) ? http::extended_valid_nonce_period : http::valid_nonce_period; | |||
There was a problem hiding this comment.
This ternary is no longer needed with a max_valid_age of 300.
| // can cause an infinit upload loop, if the browser does not read errors | ||
| // before sending the whole body. | ||
| static const uint32_t valid_nonce_period = 5; | ||
| static const uint32_t extended_valid_nonce_period = 8; |
There was a problem hiding this comment.
The extended_valid_nonce_period variable is no longer needed, since the only value used in now 300.
The initial valid period for the HTTP Digest Auth nonce was too low (at 5 seconds). This make it impossible to log into PrusaLink when using Safari, a saner value of 300 (chosen because it's Apache's default value) does not hinder security and fixes the issue with Safari-based browsers (macOS, ipadOS, iOS). See prusa3d#3287 for more details.
|
Thank you for finding the cause (I'd still tend to claim the root cause is on safari's side, since the RFC claims the client may wish to retry with new nonce without reprompting the user…). I'm going to rebase to get rid of conflicts and fix the tests, then accept it. |
Great news, thank you for moving this forward 👌 |
The initial valid period for the HTTP Digest Auth nonce was too low (at 5 seconds).
This make it impossible to log into PrusaLink when using Safari, a saner value of 300 (chosen because it's Apache's default value) does not hinder security and fixes the issue with Safari-based browsers (macOS, ipadOS, iOS).
See #3287 and prusa3d/Prusa-Link-Web#386 for more details.