Package rfc7616

import "funnyhaha.technology/rfc/rfc7616"

Overview

Package rfc7616 implements HTTP Digest calculations and field syntax. It owns no HTTP state. See RFC 7616, Sections 3.3–3.5. MD5 and no-qop are retained solely for legacy peers; applications should prefer SHA-256 or SHA-512-256.

Index

• Variables
• func Authorization
• func Compute
• func VerifyInfo
• type Challenge
  • func ParseChallenge
  • func (Challenge) Header
• type Credentials
• type Fields
  • func Parse
  • func ParseInfo
• type Password
  • func NewPassword
  • func (Password) Format
  • func (Password) GoString
  • func (Password) Reveal
  • func (Password) String

Variables

var (
	// ErrSyntax means a Digest field is malformed or inconsistent.
	ErrSyntax = errors.New("invalid Digest field")
	// ErrAlgorithm means the requested algorithm is unsupported.
	ErrAlgorithm = errors.New("unsupported Digest algorithm")
	// ErrVerification means the server's response authentication did not match.
	ErrVerification = errors.New("digest response verification failed")
)

Functions

Authorization source

func Authorization(c Challenge, p Credentials) (string, error)

Authorization formats a request, including username* for extended UTF-8 usernames (RFC 8187), or userhash when the server offers it.

Compute source

func Compute(c Challenge, p Credentials, response bool) (string, error)

Compute calculates request-digest or rspauth (when response is true), using RFC 7616, Sections 3.4.1–3.4.3 and 3.5. Session variants also require cnonce without qop. No-qop calculation is RFC 2069 compatibility, not a default offer.

VerifyInfo source

func VerifyInfo(value string, c Challenge, p Credentials) (string, error)

VerifyInfo verifies rspauth and echoed qop/cnonce/nc, returning nextnonce only after authentication succeeds. For auth-int p.Body must be the response body. RFC 7616 Section 3.5 requires rspauth, cnonce and nc with qop, so a missing one fails verification. Without qop, rspauth is optional: when it's absent the server hasn't authenticated itself, and nextnonce is returned as sent.

Types

Challenge source

type Challenge struct {
	Realm, Nonce, Algorithm, Opaque, Charset string
	QOP                                      []string
	Stale, Userhash                          bool
	// OpaquePresent distinguishes an explicitly empty opaque directive from absence.
	OpaquePresent bool
}

Challenge describes the server's offer, including legacy no-qop offers.

ParseChallenge source

func ParseChallenge(value string) (Challenge, error)

ParseChallenge checks required directives and supported encoding and algorithm.

(Challenge) Header source

func (c Challenge) Header() (string, error)

Header constructs a challenge with the field-specific quoting mandated by RFC 7616, Section 3.3 (algorithm and booleans are tokens, qop is quoted).

Credentials source

type Credentials struct {
	Username                 string
	Password                 Password
	Method, URI, CNonce, QOP string
	NonceCount               uint32
	Body                     []byte
}

Credentials supplies all inputs for one request. Body is the exact entity body for auth-int. NonceCount is mandatory with qop; nonces are caller-owned. When the challenge's charset is UTF-8, RFC 7616 Section 4 expects Username and Password in Unicode Normalization Form C. The caller normalises them; this package hashes the bytes it is given.

Fields source

type Fields map[string]string

Fields contains lower-case directive names and unescaped values.

Parse source

func Parse(value string) (Fields, error)

Parse parses one Digest challenge or authorization, rejecting duplicates and malformed quoting. See RFC 7616, Sections 3.3 and 3.4.

ParseInfo source

func ParseInfo(rest string) (Fields, error)

ParseInfo parses Authentication-Info's directive list, which has no scheme.

Password source

type Password struct {
	// contains filtered or unexported fields
}

Password deliberately hides its contents from fmt, including Go syntax. Keeping the secret behind a closure also prevents fmt's reflection fallback from exposing it through unexported fields of a containing adapter.

NewPassword source

func NewPassword(value string) Password

NewPassword wraps a secret without trimming it.

(Password) Format source

func (p Password) Format(s fmt.State, _ rune)

Format redacts every fmt verb, including structured formatting.

(Password) GoString source

func (p Password) GoString() string

GoString redacts Go syntax formatting.

(Password) Reveal source

func (p Password) Reveal() string

Reveal explicitly retrieves the secret for authentication.

(Password) String source

func (p Password) String() string

String redacts the password.