[Live-devel] RTSPClient - unable to authenticate after redirection.

[Ross Finlayson]

Hmm, this got changed (just over a month ago) because of a security issue that was reported to me.

The problem was the possibility that a RTSP server (that uses Digest authentication) would send back a ‘redirect’ (code 302) that points to another RTSP server that uses Basic authentication.  In this case, when the RTSP client contacted the second server, it would send the username and password ‘in the clear’ to the second server.  This is arguably a security violation, because the first server (that uses Digest authentication) was not ever expecting its username+password to be exposed over the network.

In your case, however, your second server is also using Digest authentication, so there is no problem reusing the original username+password for the second connection.

I think a better solution would be to for the client not to “reset()” the Authenticator, but instead to reject any future requests for Basic authentication if it has already handled a request for Digest authentication.

I’ll make this change in the next release of the software.


Ross Finlayson
Live Networks, Inc.
http://www.live555.com/