eidheim / Simple-Web-Server

A very simple, fast, multithreaded, platform independent HTTP and HTTPS server and client library implemented using C++11 and Boost.Asio. Created to be an easy way to make REST resources available from C++ applications.
MIT License
2.61k stars 751 forks source link

Accessing request->header not safe? #175

Closed pp23 closed 6 years ago

pp23 commented 6 years ago

Hi,

maybe I have encountered a bug with request->header:

      const auto headerMap = request->getHeader();
      const auto it = headerMap.find("Authorization");
      if(it == headerMap.cend()) {
         throw std::runtime_error("Authorization header not set");
      }
      const auto authHeaderIt = request->getHeader().find("Authorization");
      if(authHeaderIt == request->getHeader().cend()) {
         throw std::runtime_error("Authorization header not set");
      }
      LOG_INFO << "it: " << it->first << " :: " << it->second;
      LOG_INFO << "authHeaderIt: " << authHeaderIt->first << " :: " << authHeaderIt->second;

With this code I get the following output:

[2017-Nov-27 21:37:26]: it: authorization :: bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1MTE4OTkzNzAsInJvbGUiOiJhZG1pbiIsInVpZCI6MX0.oqaOenulprBubko6fYmtuPGrxwDq1VbJ0t59iR2YpgE [2017-Nov-27 21:37:26]: authHeaderIt: authorization :: s03sIsInR5c}3�|3eHAiOjE1%(��.ss��9;��EX�x.sss<erIt:

As you can see there are some non-ascii characters in the output when getting the value from the request header. When making a copy of the headers first, the output is ok. I still had not the time to check this in the code, but it seems, that the headers get manipulated during the execution of the resource-function?

eidheim commented 6 years ago

Are you sure you are at the right repository? We do not have a method called ´getHeader`.

pp23 commented 6 years ago

Hi,

sorry, getHeader is a function of an adapter which returns the header-member from the Request-class. The error is, that I work on the temporary copy which is made on return of the headers. An iterator on the temporary map is of course only valid until the temporary copy goes out of scope, which is already at the next code line ;-)