algermissen / hawkc Goto Github PK

Currently these functions take an int. This leads to undesired casts from size_t to int in some places.

It is not yet clear to me, how to treat escaped chars (e.g. ") in the ext-parameter. The original Hawk implementation seems to remove the escapes before calculating the signature.

However, removing them would require a string copy and thus allocation - this is something I want to avoid as much as possible in the C version in Hawk.

Matching must be case insensitive as per http://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-23#section-2.1

It would be more consistent to rename context's header_in to authorization_header_in and the same for header_out.

Minor issue - but keeps bugging me.

Creating a header value currently requires to call length calculation function first but it is not enforced. Not calling the function will lead to failure.

Enforce correct call sequence through internal state checking.

For Oz-like use cases, it would be nice to have a header parameter that told the client what kind of error lead to the 401. One case would be expired ticket.

Needs investigation, because a

4xx Credentials expired would also be a good fit.

hawkc_validate_hmac in common.c contains a 1k buffer for the base string that is not yet neither dynamic nor size-checked.

Suggested fix: use static default buffer of reasonable size, check size and use dynamic allocation if necessary.

Add a size check to prevent from writing past the buffer end.

Not a problem now as I use buffers larger than what a UNIX time can be - but to be save here would be nicer.

Hawk benefits from client and server setting their clock via SNTP.

Hawk includes the ability to add a hash of the message body to the Authorization header. This has not yet been implemented in Hawkc.