GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Add error on Legacy Credential over non-HTTPS for Web Cmdlets by markekraus · Pull Request #5402 · PowerShell/PowerShell

Conversation

@markekraus

@markekraus Mark Kraus (markekraus) commented Nov 10, 2017

Copy link
Copy Markdown
Contributor

closes #5112

  • Adds an error when a user tries to use -Credential (legacy usage without -Authentication) or -UseDefaultCredentials over a non-HTTPS URI
  • User can Bypass error with -AllowUnencryptedAuthentication
  • -UseDefaultCredentials can only be reliably tested on Windows as support on other platforms depends on a kerberos infrastructure.
  • Adds /Auth/ tests to WebListener for challenge authentication Basic, Negotiate, and NTLM

Incidentally, this increases test coverage for the web cmdlets as -Credential and -UseDefaultCredentials were not being tested.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@markekraus
[Feature] Add error on Legacy Credential over non-HTTPS for Web Cmdlets
3a61f77
@markekraus Mark Kraus (markekraus) added the Breaking-Change breaking change that may affect users label Nov 10, 2017
@markekraus
Mark Kraus (markekraus) requested review from James Truher (JamesWTruher), Paul Higinbotham (PaulHigin), Travis Plunk (TravisEz13), Aditya Patwardhan (adityapatwardhan), Dan Travison (dantraMSFT) and Dongbo Wang (daxian-dbw) as code owners November 10, 2017 00:54
@markekraus Mark Kraus (markekraus) mentioned this pull request Nov 10, 2017
Web Cmdlets should warn when legacy -Credential is sent over unencrypted connections #5112
Closed
@SteveL-MSFT

Steve Lee (SteveL-MSFT) commented Nov 10, 2017

Copy link
Copy Markdown
Member

Mark Kraus (@markekraus) you added mock NTLM support in the weblistener but didn't use it?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@markekraus
[Feature] Add missing NTLM tests
5c3344e
@markekraus

Mark Kraus (markekraus) commented Nov 10, 2017

Copy link
Copy Markdown
Contributor Author

Steve Lee (@SteveL-MSFT) whoops. NTLM tests added.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
SteveL-MSFT
Steve Lee (SteveL-MSFT) approved these changes Nov 10, 2017
View reviewed changes

@SteveL-MSFT Steve Lee (SteveL-MSFT) left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@SteveL-MSFT Steve Lee (SteveL-MSFT) assigned Dongbo Wang (daxian-dbw) Nov 10, 2017
@SteveL-MSFT

Steve Lee (SteveL-MSFT) commented Nov 10, 2017

Copy link
Copy Markdown
Member

This breaking change was approved by @PowerShell/powershell-committee
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@markekraus
[Feature] Add spelling exemption
9164e4a
@daxian-dbw
Dongbo Wang (daxian-dbw) merged commit ee7edb7 into PowerShell:master Nov 10, 2017
@markekraus Mark Kraus (markekraus) mentioned this pull request Nov 17, 2017
Web Cmdlets 6.0.0 Documentation Refresh MicrosoftDocs/PowerShell-Docs#1870
Merged
2 of 8 tasks
@markekraus
Mark Kraus (markekraus) deleted the WebCmdletsCredHttpErr branch January 19, 2018 19:00
Thatgfsj (Thatgfsj) pushed a commit to Thatgfsj-contribs/PowerShell that referenced this pull request Aug 6, 2026
@markekraus @daxian-dbw
Add error on Legacy Credential over non-HTTPS for Web Cmdlets (PowerS…
27b976b 
…hell#5402)

- Add an error when a user tries to use `-Credential` (legacy usage without `-Authentication`) or `-UseDefaultCredentials` over a non-HTTPS URI
- User can bypass error with `-AllowUnencryptedAuthentication`
- `-UseDefaultCredentials` can only be reliably tested on Windows as support on other platforms depends on a Kerberos infrastructure. 
- Add `/Auth/` tests to WebListener for challenge authentication Basic, Negotiate, and NTLM

Incidentally, this increases test coverage for the web cmdlets as `-Credential` and `-UseDefaultCredentials` were not being tested.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SteveL-MSFT Steve Lee (SteveL-MSFT) SteveL-MSFT approved these changes
@adityapatwardhan Aditya Patwardhan (adityapatwardhan) Awaiting requested review from adityapatwardhan
@dantraMSFT Dan Travison (dantraMSFT) Awaiting requested review from dantraMSFT
@daxian-dbw Dongbo Wang (daxian-dbw) Awaiting requested review from daxian-dbw
@JamesWTruher James Truher (JamesWTruher) Awaiting requested review from JamesWTruher
@PaulHigin Paul Higinbotham (PaulHigin) Awaiting requested review from PaulHigin
@TravisEz13 Travis Plunk (TravisEz13) Awaiting requested review from TravisEz13

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@daxian-dbw Dongbo Wang (daxian-dbw)

Labels

Breaking-Change breaking change that may affect users

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Web Cmdlets should warn when legacy -Credential is sent over unencrypted connections

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@markekraus @SteveL-MSFT @daxian-dbw
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.