diff options
Diffstat (limited to 'lib/http_digest.c')
| -rw-r--r-- | lib/http_digest.c | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/lib/http_digest.c b/lib/http_digest.c index be5ca5a8d..bab95e9de 100644 --- a/lib/http_digest.c +++ b/lib/http_digest.c @@ -356,7 +356,25 @@ CURLcode Curl_output_digest(struct connectdata *conn, 5.1.1 of RFC 2616) */ - md5this = (unsigned char *)aprintf("%s:%s", request, uripath); + /* So IE browsers < v7 cut off the URI part at the query part when they + evaluate the MD5 and some (IIS?) servers work with them so we may need to + do the Digest IE-style. Note that the different ways cause different MD5 + sums to get sent. + + Apache servers can be set to do the Digest IE-style automatically using + the BrowserMatch feature: + http://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html#msie + + Further details on Digest implementation differences: + http://www.fngtps.com/2006/09/http-authentication + */ + if(authp->iestyle && (tmp = strchr((char *)uripath, '?'))) { + md5this = (unsigned char *)aprintf("%s:%.*s", request, + (int)(tmp - (char *)uripath), uripath); + } + else + md5this = (unsigned char *)aprintf("%s:%s", request, uripath); + if(!md5this) { free(ha1); return CURLE_OUT_OF_MEMORY; |