MLE-24397 - fix issue on Linux FIPS reported by consultant/customer a…#963
MLE-24397 - fix issue on Linux FIPS reported by consultant/customer a…#963stevebio merged 1 commit intomarklogic:developfrom
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR fixes a FIPS compliance issue where MD5 digest algorithms were being loaded by default, causing exceptions in FIPS-enabled Linux environments. The solution incorporates code from the abandoned www-authenticate project directly into the codebase and ensures MD5 is only loaded when actually needed.
- Removes external dependency on www-authenticate package
- Incorporates www-authenticate source code into the project with lazy MD5 loading
- Adds comprehensive FIPS testing to verify MD5 is not loaded during module initialization
Reviewed Changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Removes www-authenticate dependency |
| lib/requester.js | Updates import to use local www-authenticate implementation |
| lib/www-authenticate/www-authenticate.js | Main authentication module with digest auth support |
| lib/www-authenticate/user-credentials.js | User credential handling with MD5 digest support |
| lib/www-authenticate/parsers.js | WWW-Authenticate header parsing logic |
| lib/www-authenticate/md5.js | MD5 hash function wrapper |
| test-basic/digestauth-fips-nomd5load.js | FIPS compliance test ensuring MD5 isn't loaded by default |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
…by default load of FIPS-forbidden MD5 digest algorithm. Incorporate the source from the abandoned www-authenticate project and fix in place.
db72383 to
8c9e5ff
Compare
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
…round exception caused by default load of FIPS-forbidden MD5 digest algorithm. Incorporate the source from the abandoned www-authenticate project and fix in place.