qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-27 03:21:18 -07:00
Code Releases Activity

net/http: don't overwrite Authorization headers when URL has username

Browse Source 
Fixes #11399

Change-Id: I3be7fbc86c5f62761f47122632f3e11b56cb6be6
Reviewed-on: https://go-review.googlesource.com/11510
Reviewed-by: Russ Cox <rsc@golang.org>
This commit is contained in:
Steve Streeting 2015-06-25 16:52:51 +01:00 committed by Russ Cox
parent 0d1ceef945
commit 379d8327cb
2 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/net/http/client.go
View File

@ -212,7 +212,7 @@ func send(req *Request, t RoundTripper) (resp *Response, err error) {
req.Header = make(Header)
}
if u := req.URL.User; u != nil {
if u := req.URL.User; u != nil && req.Header.Get("Authorization") == "" {
username := u.Username()
password, _ := u.Password()
req.Header.Set("Authorization", "Basic "+basicAuth(username, password))

41
src/net/http/client_test.go
View File

@ -843,6 +843,47 @@ func TestBasicAuth(t *testing.T) {
}
}
func TestBasicAuthHeadersPreserved(t *testing.T) {
defer afterTest(t)
tr := &recordingTransport{}
client := &Client{Transport: tr}
// If Authorization header is provided, username in URL should not override it
url := "http://My%20User@dummy.faketld/"
req, err := NewRequest("GET", url, nil)
if err != nil {
t.Fatal(err)
}
req.SetBasicAuth("My User", "My Pass")
expected := "My User:My Pass"
client.Do(req)
if tr.req.Method != "GET" {
t.Errorf("got method %q, want %q", tr.req.Method, "GET")
}
if tr.req.URL.String() != url {
t.Errorf("got URL %q, want %q", tr.req.URL.String(), url)
}
if tr.req.Header == nil {
t.Fatalf("expected non-nil request Header")
}
auth := tr.req.Header.Get("Authorization")
if strings.HasPrefix(auth, "Basic ") {
encoded := auth[6:]
decoded, err := base64.StdEncoding.DecodeString(encoded)
if err != nil {
t.Fatal(err)
}
s := string(decoded)
if expected != s {
t.Errorf("Invalid Authorization header. Got %q, wanted %q", s, expected)
}
} else {
t.Errorf("Invalid auth %q", auth)
}
}
func TestClientTimeout(t *testing.T) {
if testing.Short() {
t.Skip("skipping in short mode")