Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The parser for the “Basic” scheme is not RFC-compliant. #121

Open
issuefiler opened this issue Dec 1, 2022 · 0 comments
Open

The parser for the “Basic” scheme is not RFC-compliant. #121

issuefiler opened this issue Dec 1, 2022 · 0 comments

Comments

@issuefiler
Copy link

RFC 9110 defines the field value of the Authorization header as:

Authorization = credentials
credentials = auth-scheme [ 1*SP ( token68 / #auth-param ) ]

which, according to RFC 5234 — ABNF, means there can be one or more spaces between the auth-scheme and token68.

3.6.  Variable Repetition:  *Rule

   The operator "*" preceding an element indicates repetition.  The full
   form is:

         <a>*<b>element

   where <a> and <b> are optional decimal values, indicating at least
   <a> and at most <b> occurrences of the element.

   Default values are 0 and infinity so that *<element> allows any
   number, including zero; 1*<element> requires at least one;
   3*3<element> allows exactly 3; and 1*2<element> allows one or two.

// Parsing authorization header.
parseAuthorization(header) {
if (basicSchemeRegExp.test(header)) {
let tokens = header.split(" ");
return tokens[1];
}
}

Your parser assumes the 1*SP part to be a single space, , and fails to parse the valid credentials,

Basic              QWxhZGRpbjpvcGVuIHNlc2FtZQ==

erroneously returning "".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant