|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2009-08-27 10:24 UTC] michal dot kocarek at brainbox dot cz
Description: ------------ HTTP extension or cURL library uses bad authentication credentials while reusing connection. Requested behavior: 1) Request page from local NTLM-authenticated website 2) Then request page from internet over NTLM-authenticated proxy Actually, second request fails. Instead of sending ?Proxy-Authorization: NTLM ?? header, library sends out ?Authorization: NTLM ?? header and ?Proxy-Authorization: Basic ?? header. This is quite bad, because PHP tries to authenticate using Basic authorization to the proxy using passed credentials in step (2) and also tries to authenticate on target server using same credentials and NTLM method. Reproduce code: --------------- <? // Configuration for first request $r1_url = 'http://site.with.ntlm.authentication.com/'; $r1_meth = HttpRequest::METH_GET; $r1_opts = array( 'httpauth' => 'DOMAIN\\user:pass', 'httpauthtype' => HTTP_AUTH_NTLM, ); // Configuration for second request $r2_url = 'http://www.php.net/'; $r2_meth = HttpRequest::METH_GET; $r2_opts = array( 'proxytype' => HTTP_PROXY_HTTP, 'proxyhost' => 'proxyserver.with.ntlm.authentication', 'proxyport' => 80, 'proxyauth' => 'DOMAIN\\user:pass', 'proxyauthtype' => HTTP_AUTH_NTLM, ); // Send request 1 to server with NTLM authentication $r1 = new HttpRequest($r1_url, $r1_meth, $r1_opts); try { $r1->send(); } catch (HttpException $e) {} // Expect to echo "200" echo $r1->getResponseCode()."\r\n"; // Send request 2 to server over proxy with PROXY NTLM authentication $r2 = new HttpRequest($r2_url, $r2_meth, $r2_opts); try { $r2->send(); } catch (HttpException $e) {} // Expect to echo "200" echo $r2->getResponseCode()."\r\n"; ?> Expected result: ---------------- // I expect to see two times successfull HTTP result 200 200 // Expected HTTP communication (authorization headers) for the requests (1) C→S: GET / HTTP/1.1 Authorization: NTLM ? (first auth. header) ? S→C: HTTP/1.1 401 Unauthorized WWW-Authenticate: NTLM ? (second auth. header) ? C→S: GET / HTTP/1.1 Authorization: NTLM ? (final auth. header) S→C: HTTP/1.1 200 OK ? (2) C→S: GET http://www.php.net/ HTTP/1.1 Proxy-Authorization: NTLM ? (first auth. header) ? S→C: HTTP/1.1 401 Unauthorized Proxy-Authenticate: NTLM ? (second auth. header) ? C→S: GET http://www.php.net/ HTTP/1.1 Proxy-Authorization: NTLM ? (final auth. header) S→C: HTTP/1.1 200 OK ? Actual result: -------------- // However, second connection fails telling // 407 Proxy Authentication Required 200 407 // Actual HTTP communication (authorization headers) for the requests (1) C→S: GET / HTTP/1.1 Authorization: NTLM ? (first auth. header) ? S→C: HTTP/1.1 401 Unauthorized WWW-Authenticate: NTLM ? (second auth. header) ? C→S: GET / HTTP/1.1 Authorization: NTLM ? (final auth. header) S→C: HTTP/1.1 200 OK ? (2) C→S: GET http://www.php.net/ HTTP/1.1 Proxy-Authorization: Basic ? (BAD BAD BAD!) Authorization: NTLM ? (BAD BAD BAD!) ? S→C: HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: NTLM PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sun Oct 26 08:00:02 2025 UTC |
Request still fails on latest SVN version of the library. (http 1.7.0-dev, libcurl 7.19.4) Steps to reproduce: 1) Request on local webserver, without any credentials 2) Request on local webserver, with credentials 3) Request on internet over proxy with NTLM credentials Steps must be exactly in order 1 -> 2 -> 3. Other order works perfectly. During step 2, it is not important if authentication is successfull, in both cases (response 200 or 401) step 3 fails on 407. Reproduce code: --------------- <? function request($url, $method, $options) { // Send request 1 to server with NTLM authentication $r = new HttpRequest($url, $method, $options); try { $r->send(); } catch (HttpException $e) {} // Expect to echo "200" echo $r->getResponseCode()."\r\n"; } // Local request without any credentials request('http://localhost/', HttpRequest::METH_GET, array()); // Local request with NTLM login credentials request('http://prague.intranet.cliffordchance.com/homepage/', HttpRequest::METH_GET, array( 'httpauth' => 'UK\\908077:kocourek', 'httpauthtype' => HTTP_AUTH_NTLM, )); // Request over proxy with NTLM proxy credentials request('http://www.php.net/', HttpRequest::METH_POST, array( 'proxytype' => HTTP_PROXY_HTTP, 'proxyhost' => 'w2karray', 'proxyport' => 80, 'proxyauth' => 'UK\\908077:kocourek', 'proxyauthtype' => HTTP_AUTH_NTLM, )); ?> Expected result: ---------------- 200 200 200 Actual result: -------------- 200 200 407