From 415da714fa2b7e96743e14fe0a33f02ae8c8dd5b Mon Sep 17 00:00:00 2001 From: Benoit Sigoure Date: Mon, 22 Apr 2019 14:35:01 -0700 Subject: [PATCH] net/http: document that Basic Auth may require URL encoding Explicitly warn callers that no URL encoding is performed and that they might need to do it. Fixes #31577 Change-Id: I52dc3fd2798ba8c3652d4a967b1c5c48eb69f43b Reviewed-on: https://go-review.googlesource.com/c/go/+/173319 Reviewed-by: Brad Fitzpatrick --- src/net/http/request.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/net/http/request.go b/src/net/http/request.go index da5ac2c71b..8afe1a7c0c 100644 --- a/src/net/http/request.go +++ b/src/net/http/request.go @@ -912,6 +912,10 @@ func parseBasicAuth(auth string) (username, password string, ok bool) { // // With HTTP Basic Authentication the provided username and password // are not encrypted. +// +// Some protocols may impose additional requirements on pre-escaping the +// username and password. For instance, when used with OAuth2, both arguments +// must be URL encoded first with url.QueryEscape. func (r *Request) SetBasicAuth(username, password string) { r.Header.Set("Authorization", "Basic "+basicAuth(username, password)) }