search

jshttp / basic-auth

Generic basic auth Authorization header field parser
MIT License
703 stars 86 forks source link

feat: add support for URL encoded values #48

Closed andrei-cdl closed 3 years ago

andrei-cdl commented 3 years ago

due to a bug in node.js some clients will end up encoding the value before base64 which results in the incorrect value being parsed.

ref: https://github.com/nodejs/node/issues/31439

dougwilson commented 3 years ago

Thank you for this pull request. This is unfortunately not how the header works according to the specification. Doing this would have security implications as clients who follow the spec im combination with this change would allow the username as seen by the client be different as seen by the server, by the nature of the colon separator being hidden in the username.

I'm sure the are various clients who can be buggy; I would suggeset filing an issue with the buggy client so they provide a correctly-formatted header.

andrei-cdl commented 3 years ago

ah interesting, thanks for looking into it. I didn't realize there would be security implications due to that change.