pcibraro / hawknet

Hawk protocol implementation for .NET
MIT License
114 stars 35 forks source link

Exception: The format of value '<null>' is invalid #30

Open orozcoc opened 9 years ago

orozcoc commented 9 years ago

When running Example.Owin against a non-secured controller (no Authorize attribute) and no signed http client, the exception The format of value '< null >' is invalid is thrown. This is happening in the file hawknet.owin\hawkauthenticationhandler.cs, line 156 due to an unsafe attempt to parse Request.Headers["authorization"]:

https://github.com/pcibraro/hawknet/blob/master/HawkNet.Owin/HawkAuthenticationHandler.cs#L156

var authorization = AuthenticationHeaderValue.Parse(Request.Headers["authorization"]);

I fixed it by modifying line 154 to: https://github.com/pcibraro/hawknet/blob/master/HawkNet.Owin/HawkAuthenticationHandler.cs#L154

if (this.Options.IncludeServerAuthorization && Request.Headers.ContainsKey("authorization"))

Not sure if this breaks your security logic, if it doesn't do you think this fix could be included in the Nuget package?

Thanks

Camilo