Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Add error on Legacy Credential over non-HTTPS for Web Cmdlets#5402

Merged
daxian-dbw merged 3 commits into
PowerShell:masterPowerShell/PowerShell:masterfrom
markekraus:WebCmdletsCredHttpErrmarkekraus/PowerShell:WebCmdletsCredHttpErrCopy head branch name to clipboard
Nov 10, 2017
Merged

Add error on Legacy Credential over non-HTTPS for Web Cmdlets#5402
daxian-dbw merged 3 commits into
PowerShell:masterPowerShell/PowerShell:masterfrom
markekraus:WebCmdletsCredHttpErrmarkekraus/PowerShell:WebCmdletsCredHttpErrCopy head branch name to clipboard

Conversation

@markekraus

Copy link
Copy Markdown
Contributor

closes #5112

  • Adds an error when a user tries to use -Credential (legacy usage without -Authentication) or -UseDefaultCredentials over a non-HTTPS URI
  • User can Bypass error with -AllowUnencryptedAuthentication
  • -UseDefaultCredentials can only be reliably tested on Windows as support on other platforms depends on a kerberos infrastructure.
  • Adds /Auth/ tests to WebListener for challenge authentication Basic, Negotiate, and NTLM

Incidentally, this increases test coverage for the web cmdlets as -Credential and -UseDefaultCredentials were not being tested.

@SteveL-MSFT

Copy link
Copy Markdown
Member

@markekraus you added mock NTLM support in the weblistener but didn't use it?

@markekraus

Copy link
Copy Markdown
Contributor Author

@SteveL-MSFT whoops. NTLM tests added.

@SteveL-MSFT SteveL-MSFT left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@SteveL-MSFT

Copy link
Copy Markdown
Member

This breaking change was approved by @PowerShell/powershell-committee

@daxian-dbw daxian-dbw merged commit ee7edb7 into PowerShell:master Nov 10, 2017
@markekraus markekraus deleted the WebCmdletsCredHttpErr branch January 19, 2018 19:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Breaking-Change breaking change that may affect users

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Web Cmdlets should warn when legacy -Credential is sent over unencrypted connections

3 participants

Morty Proxy This is a proxified and sanitized view of the page, visit original site.