From 88b21a43a3139d22f4c1ea96d5ccfc292e8a5121 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre.alapetite@alexandra.dk>
Date: Tue, 10 Oct 2023 13:20:37 +0200
Subject: [PATCH] Remove Digest method Based on obsolete MD5

---
 README.md                 |   9 +--
 nodes/http-auth-cred.html |  12 +---
 nodes/http-auth-cred.js   |   1 -
 nodes/http-auth-file.html |  10 +--
 nodes/http-auth-file.js   |   1 -
 nodes/http-auth.html      |  22 ++-----
 nodes/http-auth.js        | 130 +-------------------------------------
 7 files changed, 16 insertions(+), 169 deletions(-)

diff --git a/README.md b/README.md
index 91fa78a..83e52e2 100644
--- a/README.md
+++ b/README.md
@@ -1,9 +1,9 @@
 # node-red-contrib-httpauth
 
-Node-RED node for HTTP Basic/Digest Auth
+Node-RED node for HTTP Basic Auth.
 
-This Node-RED module performs Basic and Digest authentication.
-It is to be used in conjunction with an http input node.
+This Node-RED module performs HTTP Basic authentication.
+It is to be used in conjunction with an HTTP Input node.
 
 ![flow.png](images/flow.png)
 
@@ -19,11 +19,8 @@ There are three type of configuration:
 
 With all three config types you must specify the following:
 
- - Auth Type: what authentication type will be used: Basic, Digest
  - Realm: what realm will be used with this node
  - Hashed: are the passwords in the Password field or in the credentials file hashed.
-   This field is only relavent if Auth Type is Digest. It has no effect on Basic.
-   Hash format: MD5(Username:Realm:Password)
 
 With Shared and Not Shared config types you must specify the following:
 
diff --git a/nodes/http-auth-cred.html b/nodes/http-auth-cred.html
index 6092a34..0192626 100644
--- a/nodes/http-auth-cred.html
+++ b/nodes/http-auth-cred.html
@@ -4,13 +4,14 @@
 		category: 'config',
 		defaults: {
 			name: { value: '' },
-			authType: { value: 'Basic', required: true },
 			realm: { value: '', required: true },
 			username: { value: '', required: true },
 			password: { value: '', required: true },
 			hashed: { value: false, required: true },
 		},
-		label: function () { return this.name.trim() || '[' + this.authType + '] ' + this.realm.trim() + ':' + this.username.trim() + ':*****'; },
+		label: function () {
+			return this.name.trim() || this.realm.trim() + ':' + this.username.trim() + ':*****';
+		},
 	});
 </script>
 
@@ -19,13 +20,6 @@
 		<label for="node-config-input-name"><i class="fa fa-tag"></i> Name</label>
 		<input type="texth" id="node-config-input-name" />
 	</div>
-	<div class="form-row">
-		<label for="node-config-input-authType"><i class="fa fa-list"></i> Auth Type</label>
-		<select id="node-config-input-authType">
-			<option value="Basic">Basic</option>
-			<option value="Digest">Digest</option>
-		</select>
-	</div>
 	<div class="form-row">
 		<label for="node-config-input-realm"><i class="fa fa-globe"></i> Realm</label>
 		<input type="text" id="node-config-input-realm" />
diff --git a/nodes/http-auth-cred.js b/nodes/http-auth-cred.js
index 3d8f6bf..941ce88 100644
--- a/nodes/http-auth-cred.js
+++ b/nodes/http-auth-cred.js
@@ -4,7 +4,6 @@ module.exports = function (RED) {
 	function HttpAuthCredNode(config) {
 		RED.nodes.createNode(this, config);
 
-		this.authType = config.authType;
 		this.realm = config.realm;
 		this.username = config.username;
 		this.password = config.password;
diff --git a/nodes/http-auth-file.html b/nodes/http-auth-file.html
index 917cb21..fca4eb4 100644
--- a/nodes/http-auth-file.html
+++ b/nodes/http-auth-file.html
@@ -4,13 +4,12 @@
 		category: 'config',
 		defaults: {
 			name: { value: '' },
-			authType: { value: 'Basic', required: true },
 			realm: { value: '', required: true },
 			filePath: { value: '', required: true },
 			hashed: { value: false, required: true },
 		},
 		label: function () {
-			return this.name.trim() || '[' + this.authType + '] ' + this.realm.trim() + ':' + this.filePath.trim();
+			return this.name.trim() || this.realm.trim() + ':' + this.filePath.trim();
 		},
 	});
 </script>
@@ -20,13 +19,6 @@
 		<label for="node-config-input-name"><i class="fa fa-tag"></i> Name</label>
 		<input type="texth" id="node-config-input-name" />
 	</div>
-	<div class="form-row">
-		<label for="node-config-input-authType"><i class="fa fa-list"></i> Auth Type</label>
-		<select id="node-config-input-authType">
-			<option value="Basic">Basic</option>
-			<option value="Digest">Digest</option>
-		</select>
-	</div>
 	<div class="form-row">
 		<label for="node-config-input-realm"><i class="fa fa-globe"></i> Realm</label>
 		<input type="text" id="node-config-input-realm" />
diff --git a/nodes/http-auth-file.js b/nodes/http-auth-file.js
index 0872882..e2dcab6 100644
--- a/nodes/http-auth-file.js
+++ b/nodes/http-auth-file.js
@@ -36,7 +36,6 @@ module.exports = function (RED) {
 			}
 		}
 
-		this.authType = config.authType;
 		this.realm = config.realm;
 		this.getUser = function (_realm, _username) {
 			const _realmL = _realm.trim().toLowerCase();
diff --git a/nodes/http-auth.html b/nodes/http-auth.html
index 14461eb..a242439 100644
--- a/nodes/http-auth.html
+++ b/nodes/http-auth.html
@@ -8,7 +8,6 @@
 			name: { value: '' },
 			file: { value: '', type: 'node-red-contrib-httpauthfile', required: false },
 			cred: { value: '', type: 'node-red-contrib-httpauthcred', required: false },
-			authType: { value: 'Basic' },
 			realm: { value: '' },
 			username: { value: '' },
 			password: { value: '' },
@@ -38,13 +37,6 @@
 		<input type="text" id="node-input-cred" />
 	</div>
 	<hr />
-	<div class="form-row">
-		<label for="node-input-authType"><i class="fa fa-list"></i> Auth Type</label>
-		<select id="node-input-authType">
-			<option value="Basic">Basic</option>
-			<option value="Digest">Digest</option>
-		</select>
-	</div>
 	<div class="form-row">
 		<label for="node-input-realm"><i class="fa fa-globe"></i> Realm</label>
 		<input type="text" id="node-input-realm" />
@@ -64,9 +56,12 @@
 </script>
 
 <script type="text/x-red" data-help-name="node-red-contrib-httpauth">
-<p>Node-RED node for HTTP Basic/Digest Auth</p>
+<p>Node-RED node for HTTP Basic Auth</p>
 
-<p>This Node-RED module performs Basic and Digest authentication.<br />It is to be used in conjunction with an http input node.</p>
+<p>
+	This Node-RED module performs Basic authentication.
+	It is to be used in conjunction with an HTTP Input node.
+</p>
 
 <p>
 	<img src="https://raw.githubusercontent.com/alexandrainst/node-red-http-basic-auth/main/images/flow.png" />
@@ -85,13 +80,8 @@ <h2>Config</h2>
 
 <p>With all three config types you must specify the following:</p>
 <ul>
-	<li>Auth Type: what authentication type will be used: Basic, Digest</li>
 	<li>Realm: what realm will be used with this node</li>
-	<li>
-		Hashed: are the passwords in the Password field or in the credentials file hashed.<br />
-		This field is only relavent if Auth Type is Digest. It has no effect on Basic.<br />
-		Hash format: MD5(Username:Realm:Password)
-	</li>
+	<li>Hashed: are the passwords in the Password field or in the credentials file hashed.</li>
 </ul>
 
 <p>With Shared and Not Shared config types you must specify the following:</p>
diff --git a/nodes/http-auth.js b/nodes/http-auth.js
index 00ae640..9a6f3b3 100644
--- a/nodes/http-auth.js
+++ b/nodes/http-auth.js
@@ -1,7 +1,3 @@
-const crypto = require('crypto');
-
-const sessions = {};
-
 function basicAuth(authStr, node, msg) {
 	const values = Buffer.from(authStr, 'base64').toString().split(':');
 	const username = values[0];
@@ -15,120 +11,9 @@ function basicAuth(authStr, node, msg) {
 	}
 }
 
-function digestAuth(authStr, node, msg) {
-	const values = authStr.split(', ');
-	let method = msg.req.route.method;
-
-	// Bluemix workaround
-	if (!method && msg.req.route.methods) {
-		for (const _method in msg.req.route.methods) {
-			if (!method && msg.req.route.methods[_method]) {
-				method = _method;
-			}
-		}
-	}
-
-	const auth = { method: method.toUpperCase() };
-
-	for (let index = 0; index < values.length; index++) {
-		const value = values[index].trim();
-		const prop = value.match(/^\w+\b/)[0].toLowerCase();
-		auth[prop] = value.substring(prop.length + 1);
-		auth[prop] = auth[prop].search('"') == 0 ? auth[prop].substring(1, auth[prop].length - 1) : auth[prop];
-	}
-
-	const user = node.httpauthconf.getUser(auth.realm, auth.username);
-	const session = sessions[auth.nonce + auth.opaque];
-
-	if (user && session) {
-		let ha1 = null;
-
-		if (user.hashed) {
-			ha1 = user.password;
-		} else {
-			const hash = crypto.createHash('md5');
-			hash.update(auth.username + ':' + auth.realm + ':' + user.password, 'utf8');
-			ha1 = hash.digest('hex');
-		}
-
-		if (auth.algorithm == 'MD5-sess') {
-			const hash = crypto.createHash('md5');
-			hash.update(ha1 + ':' + auth.nonce + ':' + auth.cnonce, 'utf8');
-			ha1 = hash.digest('hex');
-		}
-
-		let hash = crypto.createHash('md5');
-		hash.update(auth.method + ':' + auth.uri, 'utf8');
-		const ha2 = hash.digest('hex');
-
-		hash = crypto.createHash('md5');
-		hash.update(ha1 + ':' + auth.nonce + ':' + auth.nc + ':' + auth.cnonce + ':' + auth.qop + ':' + ha2, 'utf8');
-		const response = hash.digest('hex');
-
-		if (auth.response == response) {
-			const timestamp = (new Date()).getTime();
-
-			if (session.expires > timestamp) {
-				session.expires = timestamp;
-				node.send(msg);
-			} else {
-				delete sessions[auth.nonce + auth.opaque];
-				unAuth(node, msg, true);
-			}
-		} else {
-			unAuth(node, msg);
-		}
-	} else {
-		unAuth(node, msg);
-	}
-}
-
-function digestSession(realm) {
-	const date = new Date();
-	const timestamp = date.getTime();
-	const expires = timestamp + 10000; // 10 seconds from now
-	const random = Math.random(timestamp);
-	const nonce = Buffer.from(timestamp + ':' + random).toString('base64');
-	const opaque = Buffer.from(String(timestamp + random)).toString('base64');
-	const qop = 'auth';
-	const algorithm = 'MD5-sess';
-
-	return {
-		timestamp,
-		expires,
-		random,
-		realm,
-		nonce,
-		opaque,
-		qop,
-		algorithm,
-	};
-}
-
 function unAuth(node, msg, stale) {
 	const res = msg.res._res || msg.res; // Resolves deprecates warning messages.
-
-	switch (node.httpauthconf.authType) {
-		case 'Digest': {
-			const session = digestSession(node.httpauthconf.realm);
-			sessions[session.nonce + session.opaque] = session;
-
-			res.set('WWW-Authenticate',
-				'Digest realm="' + session.realm + '"' +
-				', nonce="' + session.nonce + '"' +
-				', opaque="' + session.opaque + '"' +
-				', qop="' + session.qop + '"' +
-				', algorithm="' + session.algorithm + '"' +
-				(stale ? ', stale="true"' : ''),
-			);
-			break;
-		}
-		case 'Basic':
-		default:
-			res.set('WWW-Authenticate', 'Basic realm="' + node.httpauthconf.realm + '"');
-			break;
-	}
-
+	res.set('WWW-Authenticate', 'Basic realm="' + node.httpauthconf.realm + '"');
 	res.type('text/plain');
 	res.status(401).send('401 Unauthorized');
 }
@@ -140,7 +25,6 @@ module.exports = function (RED) {
 		RED.nodes.createNode(this, config);
 
 		let src = 'inline';
-		let authType = config.authType;
 		let realm = config.realm.trim();
 		let realmL = realm.toLowerCase();
 		let username = config.username.trim();
@@ -162,7 +46,6 @@ module.exports = function (RED) {
 		const cred = RED.nodes.getNode(config.cred);
 		if (cred) {
 			src = 'cred';
-			authType = cred.authType;
 			realm = cred.realm.trim();
 			realmL = realm.toLowerCase();
 			username = cred.username.trim();
@@ -174,7 +57,6 @@ module.exports = function (RED) {
 		const file = RED.nodes.getNode(config.file);
 		if (file) {
 			src = 'file';
-			authType = file.authType;
 			realm = file.realm.trim();
 			realmL = realm.toLowerCase();
 			getUser = file.getUser;
@@ -182,7 +64,6 @@ module.exports = function (RED) {
 
 		this.httpauthconf = {};
 		this.httpauthconf.src = src;
-		this.httpauthconf.authType = authType;
 		this.httpauthconf.realm = realm;
 		this.httpauthconf.getUser = getUser;
 
@@ -192,14 +73,9 @@ module.exports = function (RED) {
 			const header = msg.req.get('Authorization');
 			const authType = header ? header.match(/^\w+\b/)[0] : null;
 
-			if (header && authType == node.httpauthconf.authType) {
+			if (header && authType === 'Basic') {
 				const authStr = header.substring(authType.length).trim();
-
-				switch (authType) {
-					case 'Basic': basicAuth(authStr, node, msg); break;
-					case 'Digest': digestAuth(authStr, node, msg); break;
-					default: unAuth(node, msg);
-				}
+				basicAuth(authStr, node, msg);
 			} else {
 				unAuth(node, msg);
 			}