search

byorgey / haxr

Other
10 stars 16 forks source link

Fix basic authentication from parsed password #13

Closed jamesdabbs closed 8 years ago

jamesdabbs commented 8 years ago

uriUserInfo includes the trailing @ in the password, which should not be part of the setAuthorizationBasic call, which was breaking any authenticated RPC call that I tried to make.

Please let me know if you'd prefer a different way of going about this or have thoughts about writing tests or anything (first Haskell PR here, so I'm overly anxious about it). Cheers!

byorgey commented 8 years ago

Hi @jamesdabbs , thanks very much! No need to be anxious. =)

I hadn't really looked at this part of the code before. But after reading about URI schemes, looking at the network-uri documentation, and trying some examples, it seems to me that there is another bug in the code as well. Namely, if a URI has no colon before the @ , like http://byorgey@haskell.org, then byorgey is a username, not a password. Currently the code just does break (==':') without even checking whether a colon is present. Does this make sense to you?

Note, I'm not asking you to do anything in particular or change anything about your code, at this point I'm just trying to understand things!

byorgey commented 8 years ago

See https://en.wikipedia.org/wiki/Uniform_Resource_Identifier and https://hackage.haskell.org/package/network-uri-2.6.0.3/docs/Network-URI.html .

byorgey commented 8 years ago

After looking into this some more, I can no longer find anything which says that byorgey@haskell.org would be valid. So I think I'm just going to merge this as-is. Thanks again for the patch, and sorry for the long delay!