Tickets :: Comment on [#9438] authentication fails via syncml

* Your Email Address
* Spam protection	Enter the letters below: . ..__..__.. ._. \| \|\| \|\| \|\| \| \|__\|\|__\\|__\|\|____\|_
Comment	> Jan, > > Sorry, I did not do a very good job of explaining. > > Basically, the problem occurs when the client makes multiple requests > to the server. > > The first request starts the session with the md5(sessionId . > deviceId) [KEY A]. Then it authenticates successfully, which causes > the server to regenerate the session key [KEY B]. Then, at close(), > the server stores that the client is auth'd under the new session key > [KEY B]. > > The client makes a second request, which does not include auth data, > because it auth'd successfully on the first request. However, it is > not aware of the new session id, as there is no facility in SyncML > for the server to regenerate the session key. So, the server starts > a session with md5(sessionId . deviceId) [KEY A] and looks to see if > the client is auth'd, but it isn't, because the auth data was stored > under a different session key [KEY B]. So this time the client > request fails because the server does not recognize it as being > authenticated. > > Sorry if I am still not being clear. > > -- Logan
Attachment
Watch this ticket