extern/bruno
1
0
Fork 1
mirror of https://github.com/usebruno/bruno.git synced 2025-02-16 17:51:48 +01:00
Code Issues Packages Projects Releases Wiki Activity

INTERNAL | correcting WSSE logic (#3252)

Browse Source
This commit is contained in:
dwolter-emarsys 2024-10-03 13:53:40 -04:00 committed by GitHub
parent 6bc8acd1e1
commit 93f8d916c4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
packages/bruno-cli/src/runner/prepare-request.js
View File

@ -76,17 +76,17 @@ const prepareRequest = (request, collectionRoot) => {
const password = get(request, 'auth.wsse.password', ''); const password = get(request, 'auth.wsse.password', '');
const ts = new Date().toISOString(); const ts = new Date().toISOString();
const nonce = crypto.randomBytes(16).toString('base64'); const nonce = crypto.randomBytes(16).toString('hex');
// Create the password digest using SHA-256 // Create the password digest using SHA-1 as required for WSSE
const hash = crypto.createHash('sha256'); const hash = crypto.createHash('sha1');
hash.update(nonce + ts + password); hash.update(nonce + ts + password);
const digest = hash.digest('base64'); const digest = Buffer.from(hash.digest('hex').toString('utf8')).toString('base64');
// Construct the WSSE header // Construct the WSSE header
axiosRequest.headers[ axiosRequest.headers[
'X-WSSE' 'X-WSSE'
] = `UsernameToken Username="${username}", PasswordDigest="${digest}", Created="${ts}", Nonce="${nonce}"`; ] = `UsernameToken Username="${username}", PasswordDigest="${digest}", Nonce="${nonce}", Created="${ts}"`;
} }
} }

20
packages/bruno-electron/src/ipc/network/prepare-request.js
View File

@ -224,17 +224,17 @@ const setAuthHeaders = (axiosRequest, request, collectionRoot) => {
const password = get(request, 'auth.wsse.password', ''); const password = get(request, 'auth.wsse.password', '');
const ts = new Date().toISOString(); const ts = new Date().toISOString();
const nonce = crypto.randomBytes(16).toString('base64'); const nonce = crypto.randomBytes(16).toString('hex');
// Create the password digest using SHA-256 // Create the password digest using SHA-1 as required for WSSE
const hash = crypto.createHash('sha256'); const hash = crypto.createHash('sha1');
hash.update(nonce + ts + password); hash.update(nonce + ts + password);
const digest = hash.digest('base64'); const digest = Buffer.from(hash.digest('hex').toString('utf8')).toString('base64');
// Construct the WSSE header // Construct the WSSE header
axiosRequest.headers[ axiosRequest.headers[
'X-WSSE' 'X-WSSE'
] = `UsernameToken Username="${username}", PasswordDigest="${digest}", Created="${ts}", Nonce="${nonce}"`; ] = `UsernameToken Username="${username}", PasswordDigest="${digest}", Nonce="${nonce}", Created="${ts}"`;
break; break;
case 'apikey': case 'apikey':
const apiKeyAuth = get(collectionAuth, 'apikey'); const apiKeyAuth = get(collectionAuth, 'apikey');
@ -318,17 +318,17 @@ const setAuthHeaders = (axiosRequest, request, collectionRoot) => {
const password = get(request, 'auth.wsse.password', ''); const password = get(request, 'auth.wsse.password', '');
const ts = new Date().toISOString(); const ts = new Date().toISOString();
const nonce = crypto.randomBytes(16).toString('base64'); const nonce = crypto.randomBytes(16).toString('hex');
// Create the password digest using SHA-256 // Create the password digest using SHA-1 as required for WSSE
const hash = crypto.createHash('sha256'); const hash = crypto.createHash('sha1');
hash.update(nonce + ts + password); hash.update(nonce + ts + password);
const digest = hash.digest('base64'); const digest = Buffer.from(hash.digest('hex').toString('utf8')).toString('base64');
// Construct the WSSE header // Construct the WSSE header
axiosRequest.headers[ axiosRequest.headers[
'X-WSSE' 'X-WSSE'
] = `UsernameToken Username="${username}", PasswordDigest="${digest}", Created="${ts}", Nonce="${nonce}"`; ] = `UsernameToken Username="${username}", PasswordDigest="${digest}", Nonce="${nonce}", Created="${ts}"`;
break; break;
case 'apikey': case 'apikey':
const apiKeyAuth = get(request, 'auth.apikey'); const apiKeyAuth = get(request, 'auth.apikey');