HTTP digest authentication no longer works in our app since iOS 10 due to wrong nonce-count in Authorization: Digest header generated by NSURLSession.
The same code works in iOS 9, but fail to auth in iOS 10
Create a POST request with NSURLRequest
Fire it with NSURLSession
Handle NSURLAuthenticationMethodHTTPDigest in urlSession(_:didReceive:completionHandler:) delegate
The server responds with a 401 and qop="auth" string as expected
The app requests again with the Authorization: Digest header set.
According to RFC2617:
nonce-count
This MUST be specified if a qop directive is sent (see above), and
MUST NOT be specified if the server did not send a qop directive in
the WWW-Authenticate header field. The nc-value is the hexadecimal
count of the number of requests (including the current request)
that the client has sent with the nonce value in this request. For
example, in the first request sent in response to a given nonce
value, the client sends "nc=00000001". The purpose of this
directive is to allow the server to detect request replays by
maintaining its own copy of this count - if the same nc-value is
seen twice, then the request is a replay. See the description
below of the construction of the request-digest value.
However, the nonce-count start at "nc=00000002" even for the first request in iOS 10, which cause the server to reject it.
Expect server response 200 OK
iOS 9 & Before:
POST /Tunnel/Message.aspx HTTP/1.1
Host: 172.18.70.12:3454
Accept: */*
Content-Type: application/xml
User-Agent: iViewer/1 CFNetwork/758.5.3 Darwin/15.6.0
Connection: keep-alive
Cookie:
AuthType: digest
Accept-Language: zh-tw
Content-Length: 69
Accept-Encoding: gzip, deflate
Authorization: Digest username="admin", realm="ND8422P",
nonce="cc17a78cdd96d54e012eadefe7d13d82", uri="/Tunnel/Message.aspx",
response="51587db4bcf6eeece68c4ec21108f170",
cnonce="47b8df8a980f280038834b7817250e90", nc=00000001, qop="auth"
<?xml version="1.0" encoding="UTF-8"?><GetServerInfo></GetServerInfo>
HTTP/1.0 200 OK
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/xml
Content-Length: 1127
iOS 10:
POST /Tunnel/Message.aspx HTTP/1.1
Host: 172.18.70.12:3454
Accept: */*
Content-Type: application/xml
User-Agent: iViewer/1 CFNetwork/808.0.2 Darwin/16.0.0
Connection: keep-alive
Cookie:
AuthType: digest
Accept-Language: en-us
Content-Length: 69
Accept-Encoding: gzip, deflate
Authorization: Digest username="admin", realm="ND8422P",
nonce="4b8bf8549da0c3010f031472e95f387d", uri="/Tunnel/Message.aspx",
response="91cf44bc0aadf2f743164d03b5c708c7",
cnonce="b5f9e6c69e19c1b396298d68f2aefe7e", nc=00000002, qop="auth"
<?xml version="1.0" encoding="UTF-8"?><GetServerInfo></GetServerInfo>
HTTP/1.0 401 Unauthorized
WWW-Authenticate: Digest qop="auth", realm="ND8422P", nonce="8e8b0538bb08876ac4d8203f1d14e9ac"
CSeq: 0
Is anyone facing the same issue?
The only related post I could find is:
Apple Developer Forums : Problem of the digest authentication, but no further information.
How do you fix it or get workaround on client app side without asking server side to ignore the wrong nonce-count?
Thanks.
Apple Developer Technical Support confirm that is a bug of iOS 10.
Hope it will be fixed soon.
Thank you for contacting Apple Developer Technical Support (DTS).
We believe this issue is a bug. Please file a bug report using the Bug Reporter tool https://developer.apple.com/bug-reporting/.
Update:
Apple fixed this issue in iOS 10.2 Beta 3
Chances are, the OS is sending a HEAD request first, and your server-side code isn't getting it. I would try running Charles Proxy to verify that this is what's happening.
That said, skipping a nonce count is not inherently an indication of any sort of attack. It could occur even in iOS 9 if a request got lost somehow (e.g. a network error). What's important is to ensure that the count doesn't go backwards. So I would argue that your server code is buggy and should not be rejecting that to begin with.
We have the same problem in our company as described here:
Cordova app can't connect with Dynamics NAV Web-Service (ODATA) after update to iOS 10
We can reproduce the issue both in our App and the Safari Browser with iOS 10 devices. There does not seem to be a simple client side workaround. We opened a Bug Report with Apple.
In our case the problem was solved with the 10.2 Beta release.
Related
Google Natural Language API has been working in my iOS app up until yesterday. The API started returning "permission denied" errors as of this morning. E.g:
{
"error": {
"code": 403,
"message": "The caller does not have permission",
"status": "PERMISSION_DENIED"
}
}
Example request:
POST /v1/documents:analyzeEntities?key=..... HTTP/1.1
Host: language.googleapis.com
Content-Type: application/json
Connection: keep-alive
X-Ios-Bundle-Identifier: .....
Accept: */*
Accept-Language: en-us
Content-Length: 291
Accept-Encoding: gzip, deflate
User-Agent: CardScanner/1 CFNetwork/808.2.16 Darwin/15.6.0
{"encodingType":"UTF8","document":{"type":"PLAIN_TEXT","content":"....."}}
Billing is enabled for the account (with a balance of $0). The account also has 36 days left on the trial period.
The key matches the value in the Google Cloud Platform API dashboard. I have also tried regenerating the key, and using the new key in the app.
I have also tried enabling key restrictions for iOS devices, and included the "X-Ios-Bundle-Identifier" header with the app bundle identifier.
The app also uses the Google Vision API which works without issues. Calls to the Vision API do respond to changes to the key restrictions.
Calls made from the demo page also show a permissions error message. Calls from the API explorer do work however.
Edit:
The error is also happening on the demo on the product web page. Tracing the error in Charles shows the same "permission denied" response being returned to the web page:
Edit:
Below is an example of the HTTP request and response captured from the demo page. The request and resulting error is almost identical to my app, except that the demo seems to be using http 2, whereas my app is using http 1.
HTTP request:
:method: POST
:authority: language.googleapis.com
:scheme: https
:path: /v1/documents:analyzeEntities?key=.....
content-length: 250
origin: https://cloud.google.com
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
content-type: text/plain;charset=UTF-8
accept: */*
referer: https://cloud.google.com/natural-language/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.8
{"document":{"type":"PLAIN_TEXT","content":"Google, headquartered in Mountain View, unveiled the new Android phone at the Consumer Electronic Show. Sundar Pichai said in his keynote that users love their new Android phones."},"encodingType":"UTF16"}
HTTP response:
:status: 403
vary: Origin
vary: X-Origin
vary: Referer
content-type: application/json; charset=UTF-8
content-encoding: gzip
date: Sun, 26 Feb 2017 14:52:24 GMT
server: ESF
cache-control: private
content-length: 128
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: https://cloud.google.com
access-control-expose-headers: content-encoding,date,server,content-length
alt-svc: quic=":443"; ma=2592000; v="35,34"
{
"error": {
"code": 403,
"message": "The caller does not have permission",
"status": "PERMISSION_DENIED"
}
}
We are aware of this issue and should be fixed now. Let us know if you still see the same problem.
I have experienced the same behaviour and I believe it is an undocumented change at Google's end.
I can now only make the call work via OAuth, despite the documentation suggesting that an API key is sufficient. Up until very recently it was possible to make a call with an API key only and no restrictions configured on the key.
My "answer" for what it's worth is to provide feedback on the documentation page to complain that the documentation doesn't match the behaviour. I think the wording on the page may have changed recently, but it still suggests an API key should work for testing purposes.
"TRY NATURAL LANGUAGE API" button from Google Cloud Vision API demo page doesn't work either! Looks like some bug, hope they fix it soon...
Recently I come into a trouble with CORS(Cross Origin Resource Sharing) request on Safari, both OSX and iOS, while the same request works perfectly on Chrome and Firefox. I follow the documentation of W3C and handle preflight request on server side, my response is like:
HTTP/1.0 200 OK
Access-Control-Allow-Origin: http://192.168.1.96:4399
Access-Control-Allow-Methods: POST
Access-Control-Allow-Methods: GET
Access-Control-Allow-Methods: OPTIONS
Access-Control-Allow-Headers: Origin
Access-Control-Allow-Headers: Authorization
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Headers: Accept
Access-Control-Allow-Headers: Access-Control-Request-Method
Access-Control-Allow-Headers: Access-Control-Request-Headers
Access-Control-Allow-Headers: DNT
Access-Control-Allow-Headers: X-CustomHeader
Access-Control-Allow-Headers: Content-Type
Access-Control-Max-Age: 0
Date: Fri, 25 Nov 2016 08:45:25 GMT
Origin: http://192.168.1.96:4399
Access-Control-Expose-Headers: Origin
Content-Encoding: gzip
Transfer-Encoding: chunked
Such response works fine on Chrome, Firefox, and Android Browser: a POST request is sent right after the preflight request. But on Safari, after server response the reflight request, I got such error message from console:
Failed to load resource: The network connection was lost.
I inspect the preflight response from server, but find it the same as above... After searching and trying so many times, I still can't make it work :-(
Is there anybody that come across the problem before? Could anyone figure out what mistake I've made?
Thanks very much in advance!
It's all about Safari add origin to OPTIONS request header Access-Control-Request-Headers.
So to fix it you should enable this header in Access-Control-Allow-Headers in response.
PS: see similar question CORS request not working in Safari
We have managed SNS service for Samsung mobile(feature phone, camera).
We are facging issues regarding ClientLogin API. When we request ClientLogin and then we receive response: 404 Error.
This API was only a few hours before the operation.
We can't upgrade to OAuth2, because of the device firmware update is not possible.
Is there remains to be still available?
The formats of request and response are as follows
####################### REQUEST #######################
POST /accounts/ClientLogin HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 87
Host: www.google.com
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Close
Connection: Close
Email=&Passwd=&service=lh2&source=SamsungMobile+SNS+Gateway
####################### RESPONSE #######################
HTTP/1.1 404 Not FoundContent-Type:text/plain
X-Frame-Options:DENY
Cache-control:no-cache, no-store
Pragma:no-cache
Expires:Mon, 01-Jan-1990 00:00:00 GMT
Date:Wed, 27 May 2015 00:09:55 GMT
X-Content-Type-Options:nosniff
X-XSS-Protection:1; mode=block
Content-Length:65
Server:GSE
Alternate-Protocol:443:quic,p=1
Connection:close
https://developers.google.com/accounts/docs/AuthForInstalledApps
As you can see in the link you posted Google Identity Platform
Important: ClientLogin has been officially deprecated as of April 20,
2012 and is no longer available as per our deprecation policy. We
encourage you to migrate to OAuth 2.0 as soon as possible.
ClientLogin is a deprecated authentication protocol and is being turned down on April 20, 2015. At that time, ClientLogin requests will no longer be answered. If you have existing applications that use ClientLogin, we encourage you to migrate to OAuth. The ClientLogin support in this library will be removed in the next major release.
Its not going to work anymore you will have to upgrade or retire the application.
ClientLogin has been shut down.
I'm trying to exchange an OAuth 2.0 Authorization Code for an Access Token using Google's OAuth Playground tool. So, I get to step 2 and there it shows the HTTP POST request it will be sending out to MY_SERVER (I obfuscated the exact IP address for security reasons).
To me this looks correct and if I use a POST tool with exactly this request, it does arrive on my server. Launching it from the Playground, it doesn't arrive on my web server (nothing in the logs).
Does anybody have an idea what might be going wrong?
THIS POST
POST /tb/html/token/ HTTP/1.1
Host: MY_SERVER.COM
Content-length: 170
content-type: application/x-www-form-urlencoded
user-agent: google-oauth-playground
code=Splxl0576dGF6567gFG&redirect_uri=https%3A%2F%2Fdevelopers.google.com%2Foauthplayground&client_id=jarne&scope=&client_secret=some_secret&grant_type=authorization_code
RESULTS IN
HTTP/1.1 400 Bad Request
Content-length: 105
Content-type: text/plain
An error occured while connecting to the server: Unable to fetch URL: http://MY_SERVER.COM/tb/html/token/
I know that this problem may be api specified but really need to try.
I have to requests. One made with ASIHTTP and the other one with AFNetworking. Server denies afnetworking with 401 code.
I have to adjust afnetworking to the working state, and have in mind that changes at the server side are impossible atm.
ASIHTTP (working one)
POST https://cant.post.address HTTP/1.1
Host: cant.post.address
Accept: application/json
User-Agent: My Application(iPhone; iPhone OS 6.1.3; pl_PL)
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Accept-Encoding: gzip
Connection: close
Proxy-Connection: close
Content-Length: 31
AFNETWORKING (getting denied with 401)
POST https://cant.post.address HTTP/1.1
Host: cant.post.address
Accept: application/json
Accept-Encoding: gzip, deflate
User-Agent: MyApp(iPhone; iOS 6.1.3; Scale/2.00)
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Accept-Language: pl;q=1, en;q=0.9, fr;q=0.8, de;q=0.7, ja;q=0.6, nl;q=0.5
Connection: keep-alive
Proxy-Connection: keep-alive
Content-Length: 31
There were some other headers but they were identical so I removed for simplicity. What could cause rejecting here? user-agent? Doubt that. What about Connection and Proxy-Connection? Can i change it to close in AFN?
401 is the HTTP status code "Unauthorized", which is sent back from the server when the provided credentials are invalid (incorrect username / password). Check that you're sending the correct information.
Also, JSON serialization is provided automatically when AFHTTPClient is configured correctly. See the example app in the AFNetworking repository to see how that is done.