tree 2867d73e3f7c26a83567ce0e64f68c69d39c8fee
parent 70dffdaa10419c8cab039003f8b4a883e3f5648b
author Thierry FOURNIER <tfournier@exceliance.fr> 1390475582 +0100
committer Willy Tarreau <w@1wt.eu> 1391175774 +0100
encoding latin1

BUG/MEDIUM: http/auth: Sometimes the authentication credentials can be mix between two requests

The authentication function "get_http_auth()" extract credentials from
the request and keep it this values in shared cache. This function set
a flag in the session indicating that the authentication is already
parsed and the value stored in the cache are avalaible. If this flag is
set the authorization header is not re-parsed and the shared cache is
used.

If two request are simultaneous processsed, the first one check the
credentials. After this, the second request check also it's credentials
and change the data stored in the shared cache. When the first request
re-check credentials (for many reasons), they are changed. The change
can introduce a segfault.

This patch deactivate the cache upon success. When we need
authentication information from one request, they are re-parsed and
re-decoded. However, a failure to retrieve credentials is still
cached to avoid useless lookups.

This fix needs to be backported to 1.4 as well.