StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>I see a couple of issues potentially related to your problem. It's hard to tell which ones are the actual culprits, not knowing anything about gathercontent's implementation. If you pasted an example of their 'WWW-Authenticate' header, it would be much easier to provide specific help.</p> <p>So I'm speculating what the actual cause is, but here are some actual problems that you should address anyway, to conform to the spec (i.e. protect it from breaking in the future because the server starts doing things slightly differently):</p> <ul> <li>in the <code>Authorization</code> headers you are creating, <strong>remove the double quotes</strong> around <code>nc</code>, and maybe also <code>qop</code></li> <li>I don't know what <code>qop</code> value gathercontent is using. If it's <strong><code>auth-int</code></strong>, then you'd also have to append the hashed HTTP body to <code>HA2</code>, see <a href="http://tools.ietf.org/html/rfc2617#section-3.2.2.3" rel="nofollow">#3.2.2.3 of the spec</a> - furthermore, they might be specifying <strong>a comma-separated list of qop values</strong> for you to choose from - or the server <strong>might not send a value for <code>qop</code> at all</strong>, i.e. they use the most basic from of HTTP digest auth, in which your implementation would be violating the <a href="http://tools.ietf.org/html/rfc2617#section-3.2.2" rel="nofollow">spec</a>, as then you aren't allowed to e.g. send a <code>cnonce</code>, <code>nc</code> etc.</li> <li>you try to get the realm via <code>parsedDigest['Digest realm']</code>, i.e. <strong>you are assuming that the <code>realm</code> is the first attribute after the initial <code>Digest</code></strong> keyword. That might or might not be the case, but you should not rely upon it (modify your <code>parseDigest</code> function to strip of the string <code>"Digest "</code> before splitting the rest)</li> <li>the way you use <code>parsedDigest</code>, you make the assumption that <strong>Digest</strong> is always capitalized that way, and that <strong><code>realm</code>, <code>nonce</code>, etc.</strong> are always in lowercase. According to the spec, these are all <strong>case-insensitive</strong></li> </ul> <p>A couple of unrelated issues:</p> <ul> <li>Does the server really force you to use <code>Digest authentication</code>? This is HTTPS, so you might as well do <code>Basic authentication</code>, it's way easier, and with HTTPS, just as safe. (Answering myself here, after checking out gathercontent: Basic auth is apparently <a href="http://help.gathercontent.com/customer/portal/articles/250475-getting-started-with-gathercontent-api" rel="nofollow">not possible</a>)</li> <li>As mentioned in my comment to your question, <code>cnonce</code> should be random for every request, especially, you shouldn't copy and paste it from <a href="http://en.wikipedia.org/wiki/Digest_access_authentication#Example_with_explanation" rel="nofollow">Wikipedia</a>, which makes you more vulnerable (but not an issue here, as all data goes over SSL anyway in your case)</li> </ul> <p>Regarding how to curl it - try this:</p> <pre><code>curl --data 'id=1234' --digest --user "apikey:pwd" https://abcdefg.gathercontent.com:443/api/0.1/get_pages_by_project/get_me </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload