Extend HTTP digest support with server changing nonce

sdk/lib/io/http_impl.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.io;
 
 class _HttpIncoming extends Stream<List<int>> {
   final int _transferLength;
   final Completer _dataCompleter = new Completer();
   Stream<List<int>> _stream;
@@ skipping 293 matching lines @@
       // this authenticate response.
       if (cr.scheme == _AuthenticationScheme.BASIC && !cr.used) {
         // Credentials where found, prepare for retrying the request.
         return retryWithCredentials(cr);
       }
 
       // Digest authentication only supports the MD5 algorithm.
       if (cr.scheme == _AuthenticationScheme.DIGEST &&
           (header.parameters["algorithm"] == null ||
            header.parameters["algorithm"].toLowerCase() == "md5")) {
-        // If the nonce is not set then this is the first authenticate
-        // response for these credentials.
-        // TODO(sgjesse): Check for changed nonce.
-        if (cr.nonce == null) {
-          // Set up authentication state.
+        if (cr.nonce == null || cr.nonce == header.parameters["nonce"]) {
+          // If the nonce is not set then this is the first authenticate
+          // response for these credentials. Set up authentication state.
+          if (cr.nonce == null) {
+            cr.nonce = header.parameters["nonce"];
+            cr.algorithm = "MD5";
+            cr.qop = header.parameters["qop"];
+            cr.nonceCount = 0;
+          }
+          // Credentials where found, prepare for retrying the request.
+          return retryWithCredentials(cr);
+        } else if (header.parameters["stale"] != null &&
+                   header.parameters["stale"].toLowerCase() == "true") {
+          // If stale is true retry with new nonce.
           cr.nonce = header.parameters["nonce"];
-          cr.algorithm = "MD5";
-          cr.qop = header.parameters["qop"];
-          cr.nonceCount = 0;
+          // Credentials where found, prepare for retrying the request.
+          return retryWithCredentials(cr);
         }
-        // Credentials where found, prepare for retrying the request.
-        return retryWithCredentials(cr);
       }
     }
 
     // Ask for more credentials if none found or the one found has
     // already been used. If it has already been used it must now be
     // invalid and is removed.
     if (cr != null) {
       _httpClient._removeCredentials(cr);
       cr = null;
     }
@@ skipping 771 matching lines @@
           }
         },
         onDone: () {
           close();
         });
   }
 
   _HttpClientRequest send(Uri uri, int port, String method, _Proxy proxy) {
     // Start with pausing the parser.
     _subscription.pause();
+    _Credentials cr;  // Credentials used to authorize this request.
     var outgoing = new _HttpOutgoing(_socket);
     // Create new request object, wrapping the outgoing connection.
     var request = new _HttpClientRequest(outgoing,
                                          uri,
                                          method,
                                          proxy,
                                          _httpClient,
                                          this);
     request.headers.host = uri.domain;
     request.headers.port = port;
@@ skipping 11 matching lines @@
       }
     }
     if (uri.userInfo != null && !uri.userInfo.isEmpty) {
       // If the URL contains user information use that for basic
       // authorization.
       String auth =
           CryptoUtils.bytesToBase64(_encodeString(uri.userInfo));
       request.headers.set(HttpHeaders.AUTHORIZATION, "Basic $auth");
     } else {
       // Look for credentials.
-      _Credentials cr = _httpClient._findCredentials(uri);
+      cr = _httpClient._findCredentials(uri);
       if (cr != null) {
         cr.authorize(request);
       }
     }
     // Start sending the request (lazy, delayed until the user provides
     // data).
     _httpParser.responseToMethod = method;
     _streamFuture = outgoing.done
         .then((s) {
           // Request sent, set up response completer.
           _nextResponseCompleter = new Completer();
 
           // Listen for response.
           _nextResponseCompleter.future
               .then((incoming) {
                 incoming.dataDone.then((_) {
                   if (!_dispose &&
                       incoming.headers.persistentConnection &&
                       request.persistentConnection) {
                     // Return connection, now we are done.
                     _httpClient._returnConnection(this);
                     _subscription.resume();
                   } else {
                     destroy();
                   }
                 });
+                // For digest authentication check if the server
+                // requests the client to start using a new nonce.
+                if (cr != null && cr.scheme == _AuthenticationScheme.DIGEST) {
+                  var authInfo = incoming.headers["authentication-info"];
+                  if (authInfo != null && authInfo.length == 1) {
+                    var header = new _HeaderValue.fromString(
+                        authInfo[0], parameterSeparator: ',');
+                    var nextnonce = header.parameters["nextnonce"];
+                    if (nextnonce != null) cr.nonce = nextnonce;
+                  }
+                }
                 request._onIncoming(incoming);
               })
               // If we see a state error, we failed to get the 'first'
               // element.
               // Transform the error to a HttpParserException, for
               // consistency.
               .catchError((error) {
                 throw new HttpParserException(
                     "Connection closed before data was received");
               }, test: (error) => error is StateError)
@@ skipping 974 matching lines @@
 
 
 class _RedirectInfo implements RedirectInfo {
   const _RedirectInfo(int this.statusCode,
                       String this.method,
                       Uri this.location);
   final int statusCode;
   final String method;
   final Uri location;
 }