Re: Basic Auth. Password Matching
cfb@cafer.org (Cafer Şimşek) writes:
> Hi all,
>
> I discovered a feature or bug about basic authentication mechanism.
>
> If the password matches the following[1] regexp, and includes any
> garbage characters at the end of its, server says OK.
>
> For example:
>
> our password is testing15, and the user enters testing15uaik it will
> be sent HTTP 200 Ok.
>
> I'm using Debian Sarge, Apache 2.0.54 (from apt repository), and
> latest security updates applied.
>
> Regards.
>
> [1] ^(.*)[0-9]{2}$
Ok, that was my mistake. Default it's using CRYPT (first 8
character). When using MD5 or SHA the, there is no issue.
sorry.
>
> --
> Cafer 'cfb' Şimşek
> http://cafer.org
>
--
Cafer 'cfb' Şimşek
http://cafer.org
Reply to: