libmicrohttpd

commit 888606e0040fdb8e80e0933ad9e1fed31cafc5ce
parent f438804c181e8652df4f3428f90011909d3d51e0
Author: Christian Grothoff <christian@grothoff.org>
Date:   Tue, 28 Jul 2026 10:58:39 +0200

fix algorithm parsing, string  cmp was matching wrong strings to client requests to determine selected algorithm

Diffstat:
M
src/microhttpd/gen_auth.c
 | 
14
+++++++-------

1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/src/microhttpd/gen_auth.c b/src/microhttpd/gen_auth.c
@@ -290,15 +290,14 @@ get_rq_dauth_algo (const struct MHD_RqDAuthParam *const algo_param)
       return MHD_DIGEST_AUTH_ALGO3_SHA256;
     if (MHD_str_equal_caseless_quoted_s_bin_n (algo_param->value.str, \
                                                algo_param->value.len, \
-                                               _MHD_MD5_TOKEN _MHD_SESS_TOKEN))
+                                               _MHD_SHA512_256_TOKEN))
       return MHD_DIGEST_AUTH_ALGO3_SHA512_256;
-    if (MHD_str_equal_caseless_quoted_s_bin_n (algo_param->value.str, \
-                                               algo_param->value.len, \
-                                               _MHD_SHA512_256_TOKEN \
-                                               _MHD_SESS_TOKEN))
 
-      /* Algorithms below are not supported by MHD for authentication */
+    /* Algorithms below are not supported by MHD for authentication */
 
+    if (MHD_str_equal_caseless_quoted_s_bin_n (algo_param->value.str, \
+                                               algo_param->value.len, \
+                                               _MHD_MD5_TOKEN _MHD_SESS_TOKEN))
       return MHD_DIGEST_AUTH_ALGO3_MD5_SESSION;
     if (MHD_str_equal_caseless_quoted_s_bin_n (algo_param->value.str, \
                                                algo_param->value.len, \
@@ -307,7 +306,8 @@ get_rq_dauth_algo (const struct MHD_RqDAuthParam *const algo_param)
       return MHD_DIGEST_AUTH_ALGO3_SHA256_SESSION;
     if (MHD_str_equal_caseless_quoted_s_bin_n (algo_param->value.str, \
                                                algo_param->value.len, \
-                                               _MHD_SHA512_256_TOKEN))
+                                               _MHD_SHA512_256_TOKEN \
+                                               _MHD_SESS_TOKEN))
       return MHD_DIGEST_AUTH_ALGO3_SHA512_256_SESSION;
 
     /* No known algorithm has been detected */