From 53311d61e205ad2e8e710ef90e8cd490fff99671 Mon Sep 17 00:00:00 2001
From: Erik Hesselink <hesselink@gmail.com>
Date: Thu, 27 Feb 2014 20:11:35 +0100
Subject: [PATCH] Fix authentication in Safari.

We now offer 'qop="auth"', because without it, authentication in
Safari fails immediately. With the field set to auth, authentication
seems to work in the latest Firefox, Safari, Chrome and Internet
Explorer. However, the HTTP package as used in cabal-install has a bug
where it send 'qop="auth"' without an 'nc' or 'cnonce' field. So we
are lenient: when these fields are not present, we fall back to no
qop.

Fixes #132.

[1] https://github.com/haskell/HTTP/issues/54
---
 Distribution/Server/Framework/Auth.hs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Distribution/Server/Framework/Auth.hs b/Distribution/Server/Framework/Auth.hs
index 384823940..eb465d8c5 100644
--- a/Distribution/Server/Framework/Auth.hs
+++ b/Distribution/Server/Framework/Auth.hs
@@ -248,6 +248,8 @@ getDigestAuthInfo authHeader req = do
                       nc     <- Map.lookup "nc"     authMap
                       cnonce <- Map.lookup "cnonce" authMap
                       return (QopAuth nc cnonce)
+                      `mplus`
+                      return QopNone
                     Nothing -> return QopNone
                     _       -> mzero
     return DigestAuthInfo {
@@ -293,12 +295,11 @@ headerDigestAuthChallenge (RealmName realmName) = do
     headerName = "WWW-Authenticate"
     -- Note that offering both qop=\"auth,auth-int\" can confuse some browsers
     -- e.g. see http://code.google.com/p/chromium/issues/detail?id=45194
-    -- TODO: can't even offer qop="auth" because the HTTP package does it wrong
     headerValue nonce =
       "Digest " ++
       intercalate ", "
         [ "realm="     ++ inQuotes realmName
-        , "qop="       ++ inQuotes ""
+        , "qop="       ++ inQuotes "auth"
         , "nonce="     ++ inQuotes nonce
         , "opaque="    ++ inQuotes ""
         ]