Digest Auth fix for IIS 5

IIS 5 has a bug that blocks Digest Authentication from browsers that follow the standard strictly.

This was fixed in IIS 6.

But for all the IIS 5 server admins out there, this is small comfort.

Especially since IE7 is going to display a security warning for Basic Authentication.

So on the advice of Microsoft Product Support Services, I have written a small ISAPI filter to work around this bug in IIS 5.

If you have an IIS 5 server, and want to offer Digest Authentication to non-IE browsers, this may be of use to you.

I offer this to anyone who wants to use it, with no obligation.

Caveat: if it hoses your server, I claim no responsibility.  Bear in mind that once an ISAPI is loaded successfully, IIS won't release the lock on the DLL until you restart the IIS Admin service.

In the interests of early release, there are some known issues...

The design isn't the prettiest.  For example, strlen(FIND_IN_HEADER) is calculated on every request, even though that's a constant string.  (Hopefully the compiler is smart enough to optimize that one out.)

I used the MFC ISAPI wizard, but I'm not sure whether the MFC bit is necessary.  So this could probably be lightened up.

The rewriter doesn't check to see whether the Authorization: header is really a Digest header (should start with Digest.)  This would be an easy fix... I'll implement it soon.

EDIT 4/17/2006
* Removed MFC stuff after reading David Wang's unrecommendation of MFC ISAPIs
* Check that header begins with "Digest "
* Change algorithm=MD5 -> algorithm="MD5" as well as qop=auth -> qop="auth"