qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-19 13:04:45 -07:00
Code Releases Activity

net/http: ignore case of basic auth scheme in Request.BasicAuth

Browse Source 
RFC 2617, Section 1.2: "It uses an extensible, case-insensitive
token to identify the authentication scheme"

RFC 7617, Section 2: "Note that both scheme and parameter names are
matched case-insensitively."

Fixes #22736

Change-Id: I825d6dbd4fef0f1c6add89f0cbdb56a03eae9443
Reviewed-on: https://go-review.googlesource.com/111516
Reviewed-by: Dmitri Shuralyov <dmitri@shuralyov.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This commit is contained in:
Brad Fitzpatrick 2018-05-04 17:16:49 +00:00
parent 73e38303f3
commit eed79f46c2
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/net/http/request.go
View File

@ -858,7 +858,8 @@ func (r *Request) BasicAuth() (username, password string, ok bool) {
// "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true). // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true).
func parseBasicAuth(auth string) (username, password string, ok bool) { func parseBasicAuth(auth string) (username, password string, ok bool) {
const prefix = "Basic " const prefix = "Basic "
if !strings.HasPrefix(auth, prefix) { // Case insensitive prefix match. See Issue 22736.
if len(auth) < len(prefix) || !strings.EqualFold(auth[:len(prefix)], prefix) {
return return
} }
c, err := base64.StdEncoding.DecodeString(auth[len(prefix):]) c, err := base64.StdEncoding.DecodeString(auth[len(prefix):])

5
src/net/http/request_test.go
View File

@ -607,6 +607,11 @@ var parseBasicAuthTests = []struct {
ok bool ok bool
}{ }{
{"Basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "Aladdin", "open sesame", true}, {"Basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "Aladdin", "open sesame", true},
// Case doesn't matter:
{"BASIC " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "Aladdin", "open sesame", true},
{"basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "Aladdin", "open sesame", true},
{"Basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open:sesame")), "Aladdin", "open:sesame", true}, {"Basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open:sesame")), "Aladdin", "open:sesame", true},
{"Basic " + base64.StdEncoding.EncodeToString([]byte(":")), "", "", true}, {"Basic " + base64.StdEncoding.EncodeToString([]byte(":")), "", "", true},
{"Basic" + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "", "", false}, {"Basic" + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "", "", false},